Skip to content
SPECIFICTION
Get listed

RiskRecon

riskrecon.com

Free plan WebAPI
Visit riskrecon.com
Spec score 8.1 #1 of 15 in Risk Assessment Software

What it is

RiskRecon provides cybersecurity ratings and insights to help organizations assess and act on cyber risk across their vendor ecosystems. It continuously monitors vendors and offers real-time visibility into third-party exposure. Its asset discovery uses analyst-assisted machine-learning models tailored to each monitored company to attribute assets as they change. Findings are prioritized by issue severity and estimated asset value, with estimates based on factors such as authentication, transaction capabilities, and collected data types. The platform can create risk-prioritized vendor action plans; vendors can track remediation in its portal at no cost and without time limits. RiskRecon Assessments Powered by Whistic uses AI to help answer questionnaires, summarize documentation, and check compliance across a vendor catalog. Ratings cover externally visible systems, not direct inspection of internal systems. It offers API and web access, continuous score refresh, change alerts, and full attack-surface coverage. Pricing is on request, and a 30-day trial includes a quick-start guide and access to the Solutions Consulting team. A free plan is not available, though the trial includes portal access for up to 50 vendors.

Spec sheet

What it does
RiskRecon continuously monitors and analyzes vendors’ cybersecurity practices to support third-party risk decisions.Read 15 Oct 2026 · gartner.com
Purpose
RiskRecon provides cybersecurity ratings and insights to help organizations understand and act on cyber risk.Read 30 Sep 2026 · riskrecon.com
Intended users
The maker describes use by third-party risk teams, internal security analysts, M&A teams, CISOs, and boards.Read 30 Sep 2026 · riskrecon.com
Integrations
RiskRecon lists integrations with RSA Archer, Sigma Ratings, Whistic, ServiceNow and other GRC or workflow platforms.Read 15 Oct 2026 · upguard.com
Headquarters
RiskRecon says it is headquartered in Salt Lake City, Utah, with a presence in Boston, Massachusetts.Read 30 Sep 2026 · riskrecon.com
Accuracy
RiskRecon says its asset attribution is independently certified to 99.1% accuracy.Read 30 Sep 2026 · riskrecon.com
Action plans
The service automatically creates shareable vendor action plans containing issues that violate the customer’s policy.Read 15 Oct 2026 · riskrecon.com
AI assessments
RiskRecon Assessments uses retrieval-augmented generation to create vendor and SOC 2 summaries and automate questionnaire responses.Read 15 Oct 2026 · riskrecon.com
Alliance extensibility
RiskRecon offers APIs, data feeds and OEM or white-label embedding for technology and managed-service partners.Read 15 Oct 2026 · riskrecon.com
API authentication
The API documentation specifies Bearer JWT authentication and sandbox base URLs.Read 15 Oct 2026 · docs.recordedfuture.com
API ecosystem
Axonius documents a RiskRecon adapter that uses an API key to fetch assets, findings and action-plan findings.Read 15 Oct 2026 · docs.axonius.com
API reports
The API can request executive, summary, detailed and action-plan PDF reports for a target of evaluation.Read 15 Oct 2026 · docs.recordedfuture.com
Assessment scope
RiskRecon assesses externally visible systems, so its ratings reflect an organization’s external posture rather than a direct inspection of internal systems.Read 30 Sep 2026 · riskrecon.com
Asset attribution
RiskRecon says its asset attribution is independently certified at 99.1% accuracy with a false-positive rate below 1%.Read 15 Oct 2026 · riskrecon.com
Asset discovery
Its asset discovery uses analyst-assisted machine-learning models tailored to each monitored company to attribute assets as they change over time.Read 30 Sep 2026 · riskrecon.com
Benchmarking
The platform supports comparing vendor risk performance and benchmarking against peers or industry standards.Read 15 Oct 2026 · riskrecon.com
Company facts
LinkedIn lists RiskRecon by Mastercard as privately held, founded in 2013, headquartered in Salt Lake City and employing 51–200 people.Read 15 Oct 2026 · linkedin.com
Company history
RiskRecon says it was founded by Kelly White and officially incorporated in October 2015.Read 30 Sep 2026 · riskrecon.com
Company ownership
Mastercard announced an agreement to acquire RiskRecon in December 2019, with closing expected in the first quarter of 2020.Read 15 Oct 2026 · newsroom.mastercard.com
Continuous monitoring
The platform continuously assesses vendors instead of relying only on point-in-time questionnaires.Read 15 Oct 2026 · riskrecon.com
Custom risk policy
Customers can tune security criteria and monitoring to their own risk appetite and policy requirements.Read 15 Oct 2026 · riskrecon.com
Documentation depth
Public API documentation includes parameters, enums, response codes, authentication details and example requests.Read 15 Oct 2026 · docs.recordedfuture.com
Fourth-party visibility
RiskRecon can discover and visualize fourth-party entities without requiring additional approvals or permissions.Read 15 Oct 2026 · riskrecon.com
Hosted delivery
RiskRecon’s terms describe subscriber access to hosted services rather than a downloadable self-hosted product.Read 15 Oct 2026 · riskrecon.com
Limit: G2 relevance
A G2 reviewer reported that some findings or IP addresses were outside the organization’s scope or attributed to another company.Read 15 Oct 2026 · g2.com
Limit: Gartner false positives
Gartner’s displayed dislikes include false-positive concerns, incomplete customization and lack of combined offline assessment.Read 15 Oct 2026 · gartner.com
Limit: scaling cost
The independent comparison reports that costs can rise with vendor count and may increase through add-ons or tier changes.Read 15 Oct 2026 · upguard.com
Limit: workflow dependence
The independent comparison says RiskRecon relies on integrations or manual processes for a complete assessment workflow.Read 15 Oct 2026 · upguard.com
Maker legal identity
Crunchbase identifies the legal name as RiskRecon, Inc. and lists founders Eric Blatte and Kelly White.Read 15 Oct 2026 · crunchbase.com
Notable news
Mastercard’s 2020 announcement said RiskRecon technology would support AI cyber-risk assessments across 40 security and infrastructure criteria.Read 15 Oct 2026 · newsroom.mastercard.com
Own-enterprise monitoring
The product can monitor an organization’s own internet-facing assets and identify shadow IT.Read 15 Oct 2026 · riskrecon.com
Praise: G2 efficiency
A G2 reviewer described RiskRecon as efficient and said it made background checking easier.Read 15 Oct 2026 · g2.com
Praise: G2 reporting
A G2 reviewer praised detailed reporting covering vulnerabilities, certificates, outdated software, malware indicators and data leaks.Read 15 Oct 2026 · g2.com
Praise: Gartner notifications
Gartner’s review summary highlights simple, informational notifications delivered promptly.Read 15 Oct 2026 · gartner.com
Pricing transparency
An independent comparison says RiskRecon does not publish paid pricing and requires a demo or sales conversation for a quote.Read 15 Oct 2026 · upguard.com
Prioritized findings
Findings are prioritized using issue severity and the value at risk of the affected system.Read 15 Oct 2026 · riskrecon.com
Privacy ratings
RiskRecon Privacy evaluates data-subject rights, consent management, communication encryption, geolocation, breach or enforcement events and cybersecurity.Read 15 Oct 2026 · riskrecon.com
Public API
RiskRecon exposes an authenticated REST API with endpoints for ratings, compliance standards, findings and reports.Read 15 Oct 2026 · docs.recordedfuture.com
Rating on Capterra
0.0 out of 5 from 0 reviewsRead 15 Oct 2026 · capterra.com
Rating on G2
4.5 out of 5 from 2 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.4 out of 5 from 80 reviewsRead 15 Oct 2026 · gartner.com
Rating on TrustRadius
10 out of 10 from 1 ratingRead 15 Oct 2026 · trustradius.com
Remediation tracking
RiskRecon continuously checks whether vendors fixed requested issues and removes resolved items from action plans.Read 15 Oct 2026 · riskrecon.com
Risk assessment automation
RiskRecon Assessments Powered by Whistic uses AI to help answer questionnaires, summarize documentation, and check compliance across a vendor catalog.Read 30 Sep 2026 · riskrecon.com
Risk prioritization
RiskRecon prioritizes findings using issue severity and asset value, which it estimates from factors including authentication, transaction capabilities, and collected data types.Read 30 Sep 2026 · riskrecon.com
Risk ratings
RiskRecon produces cybersecurity ratings from automated assessments using public and proprietary data.Read 15 Oct 2026 · gartner.com
Security scope limitation
RiskRecon acknowledges that outside-in monitoring only sees externally visible conditions and cannot directly observe internal controls.Read 15 Oct 2026 · riskrecon.com
Third-party monitoring
It continuously monitors vendors across an organization’s ecosystem and provides real-time visibility into third-party cyber risks.Read 30 Sep 2026 · riskrecon.com
Trial support
The 30-day trial includes a quick-start guide and access to RiskRecon’s Solutions Consulting team.Read 30 Sep 2026 · riskrecon.com
Vendor action plans
The platform creates risk-prioritized vendor action plans and lets vendors track remediation in its portal at no cost and without time restrictions.Read 30 Sep 2026 · riskrecon.com

Plans and prices

30-day free trial Free security ratings for up to 50 vendors · own-organization report · prioritized findings · onboarding guide · Solutions Consulting access Read 15 Oct 2026 · riskrecon.com
Free 30-day portal access Free 30 days · security ratings for up to 50 vendors · report on your organization · risk-prioritized findings Read 30 Sep 2026 · riskrecon.com
Paid subscription Priced on request pricing varies by vendors monitored, assessment depth and selected features Read 15 Oct 2026 · upguard.com
RiskRecon subscriptions Priced on request Pricing provided in an enrollment form or subscription documentation; contact sales for a quote Read 30 Sep 2026 · riskrecon.com

Every RiskRecon plan and price →

Strong points and limits

Strong points

  • Continuously monitors vendors across the ecosystem.
  • Prioritizes findings by severity and estimated asset value.
  • Vendors can track remediation in the portal at no cost.
  • Offers APIs, continuous score refresh, and change alerts.

Limits

  • Ratings cover external systems, not internal systems directly.
  • Subscriptions require a quote; there is no free plan.

Who it suits

RiskRecon is aimed at third-party risk teams, internal security analysts, M&A teams, CISOs, and boards. It suits organizations seeking visibility into vendors’ external cyber posture and ways to prioritize remediation.

Verdict

RiskRecon combines continuous vendor monitoring with prioritized findings and vendor remediation plans. Its ratings describe externally visible systems, while subscription pricing is provided on request.

Where Specifiction places it

Alternatives to RiskReconAll alternatives →