MasterCard acquires RiskRecon, a startup that had raised $40M to make cybersecurity risk assessments of third party vendors from publicly available data
MasterCard announced today that it is acquiring RiskRecon, a Salt Lake City startup that uses publicly available data to build security assessments of organizations.
Context & Ripple Effects
RiskRecon comes into this deal with a track record: its $25M Series B led by Accel Partners in 2018 had already positioned it as a SaaS player scoring third-party vendor security purely from publicly available data — no questionnaires, no on-site audits. For MasterCard, whose leadership includes a dedicated 'President of Cyber', the buy adds continuous vendor-risk monitoring to a network whose value depends on thousands of merchants and processors not being the weak link.
The acquisition also reads as the opening move in a pattern rather than a one-off: Mastercard went on to buy crypto-analytics firm CipherTrace in 2021 and then agreed to pay $2.65B for threat-intelligence firm Recorded Future in 2024, building a security-intelligence stack alongside its payments core.
First-order effects
- MasterCard gains in-house, data-driven security ratings of the third-party vendors in its own ecosystem, and Accel exits a startup it backed at Series B.
Second-order effects
- Rival networks face pressure to match the capability — Visa and Discover must either build equivalent vendor-risk scoring or acquire their way to it, since cardholders and regulators increasingly expect networks to police their supply chains.
- Vendors serving the payments industry now get rated by a company that also decides their market access, shifting leverage in security procurement toward whoever owns the scoring methodology.
Third-order effects
- If the CipherTrace and Recorded Future follow-ons hold as a pattern, payment networks are consolidating cybersecurity intelligence as a bundled network service — making risk scoring a competitive layer of the payments stack rather than a compliance afterthought.
- Third-party vendor security assessment drifts from questionnaire-based attestation toward continuous external measurement, with the assessors increasingly owned by the platforms whose ecosystems they grade.
The trend: Payment networks are systematically acquiring cybersecurity-intelligence firms — RiskRecon, then CipherTrace, then Recorded Future — to embed risk scoring into the services they sell alongside transactions.