MasterCard acquires RiskRecon, a startup that had raised $40M to make cybersecurity risk assessments of third party vendors from publicly available data
Ron Miller / TechCrunch :
Context & Ripple Effects
Mastercard is buying RiskRecon, a SaaS platform that rates the cybersecurity posture of third-party vendors using publicly available data — closing the loop on a company that raised a $25M Series B led by Accel Partners in 2018 before reaching roughly $40M in total funding. The deal puts vendor-risk scoring inside a payments network whose own exposure runs through millions of merchants and processors.
It also extends an acquisition pattern: Mastercard later bought crypto-analytics firm CipherTrace for anti-money-laundering forensics, and in 2024 agreed to pay $2.65B for threat-intelligence firm Recorded Future from Insight Partners. RiskRecon is the first move in that sequence.
First-order effects
- RiskRecon's public-data vendor-risk scoring now sits inside Mastercard, giving the network a native way to assess the security of merchants and partners it already touches.
- Accel Partners exits its Series B position, converting a 2018 security-SaaS bet into a payments-network outcome.
Second-order effects
- Mastercard can bundle vendor-risk ratings with its existing compliance and fraud tooling — the same bundling logic that later absorbed CipherTrace's AML forensics — making security assessment a line item on network contracts rather than a separate procurement.
Third-order effects
- If the pattern holds through the CipherTrace and $2.65B Recorded Future acquisitions, payment networks are consolidating external threat intelligence and risk scoring into their own stacks, shifting where enterprises buy security assurance — from standalone rating vendors toward the networks that process their transactions.
The trend: Payment networks are assembling security and risk-intelligence capabilities through acquisition, turning third-party risk assessment into bundled network services.