Standardized risk measures and modeled financial exposure connect third-party evaluation with enterprise governance and insurance underwriting

, /PRNewswire/ — HITRUST today announced IRIDX™, an information risk ratings company. IRIDX establishes and governs standardized methods for measuring residual information risk and estimating related financial exposure. IRIDX turns existing assurance and risk evidence into comparable, explainable measures that give enterprises, boards, underwriters and regulators a common basis for information risk decisions.

Organizations have access to extensive assurance and risk evidence, including assessments, certifications, questionnaires, telemetry and external risk signals, but lack a consistent way to evaluate it efficiently at scale and translate it into comparable measures of residual information risk. This limits their ability to assess exposure against risk appetite and incorporate the results into the broader risk-management program. Leaders need to understand how much information risk remains, what it could mean financially, whether that exposure is acceptable and how to govern, benchmark and transfer it.

“You cannot govern what you cannot consistently measure,” said Daniel Nutkis, Founder and Executive Chairman, HITRUST and Founder of IRIDX. “Financial markets rely on standardized measures of credit risk because consequential decisions require a common basis for comparison. Information risk has lacked that same foundation. IRIDX brings measurement discipline to information risk so organizations can compare residual risk, understand financial exposure, govern what they accept and make informed decisions about what they reduce, retain or transfer.”

IRIDX establishes a common measurement for information risk by giving organizations a standardized basis for interpreting assurance evidence, comparing residual risk and connecting that risk to financial exposure. That common language allows risk, security, finance, executive and board stakeholders to work from consistent measures while making decisions appropriate to their roles.

As AI impacts threats, business operations and the volume and production of assurance evidence, IRIDX helps organizations determine what that evidence demonstrates, how much confidence it merits and what it means for residual information risk. It improves third-party review efficiency and enables decisions that cannot consistently be supported today, including where to reduce risk, what exposure to accept and retain, and what to transfer.

IRIDX builds on nearly two decades of HITRUST’s expertise in cyber threat analysis, control development and assurance methodologies. HITRUST’s annual Trust Report provides evidence of its assurance track record through reported breach rates within HITRUST-certified environments. This foundation was integral to the development of IRIDX’s own methods for measuring residual information risk and estimating related financial exposure. IRIDX develops and governs these methodologies under its own governance framework, separately from HITRUST’s assurance and certification programs. It applies consistent criteria for evidence relevance, rigor and reliability, regardless of the evidence’s source or affiliation. 

Measuring Residual Risk and Financial Exposure

IRIDX’s Evidence Intelligence process evaluates assessments, certifications, questionnaires, telemetry and external signals to determine what each input demonstrates and how reliably it supports a risk determination. These evaluations determine how evidence contributes to the residual-risk measure. IRIDX delivers standardized measures and decision support through the IRIDX Score, Information Risk Financial Exposure (IRFE), and governance and benchmarking tools. The objective is not another assessment or certification. It is a consistent measurement foundation for understanding residual risk, evaluating financial exposure and making governance, underwriting and risk-transfer decisions.

The IRIDX Score measures residual information risk and explains the factors driving the result, helping teams prioritize mitigation. An evidence-confidence indicator helps distinguish control weaknesses from evidence gaps or uncertainty. Authoritative Alignment Scores show demonstrated alignment and gaps against specified regulatory, standards, supervisory and AI governance or security requirements, supporting reporting and targeted remediation.

IRFE combines IRIDX residual-risk and evidence-confidence signals with relationship-specific service, contract and business-impact information. It estimates a scenario-based Low / Base / High range of modeled gross financial exposure for a defined relationship, before insurance, indemnity, contractual recovery or other transfer mechanisms are applied. Visible assumptions and loss drivers make each estimate traceable to the relationship’s business context.

“Evaluating cyber risk is of utmost importance in every M&A transaction and for any board to properly exercise its fiduciary obligations. Clients need to understand not just what a vendor has agreed to, but what exposure the business may still carry. That means considering residual information risk and potential financial and reputational exposure alongside liability limits, indemnities and insurance,” said Mark Solomon, Managing Partner of the Dallas office of Katten Muchin Rosenman. “The value we see in IRIDX and IRFE is a more consistent basis for negotiating protections, deciding what risk to accept and documenting why. That matters both at the negotiating table and in the boardroom.”

“Third-party information risk decisions have consequences for the whole business,” said Gregory Webb, Chief Executive Officer of HITRUST. “IRIDX bridges the gap between cybersecurity risk and business decision-making, giving executives and boards a consistent, defensible basis to understand their financial exposure, prioritize risk reduction and make informed decisions about what risk to accept, retain or transfer.”

Enabling Enterprise Governance and Risk Transfer

Management and boards can compare exposure against risk appetite and approved thresholds, track the proportion of vendors within tolerance, and identify material exceptions and concentrations across vendors, services and shared dependencies. Portfolio views bring these measures together to support trend analysis and accountability for decisions and follow-up. Peer benchmarking adds context through relevant comparison groups while review coverage and evidence confidence make gaps and uncertainty visible.

“The challenge with vendor management today is that we only get a quantitative view of the number of vendors we’ve reviewed. This isn’t enough in the current threat landscape.” said Jeff Schilling, Chief Information Officer and Chief Information Security Officer at TaskUs. “We need to understand the risk we’re accepting, where it’s concentrated, and whether we’re within the thresholds we’ve set. We also need to understand the financial exposure of a vendor portfolio and a solution that helps us decide where to reduce risk and how much we’re prepared to retain and how much we need to transfer. While not a current client, as an IT decision maker, the value I see in IRIDX is giving management and the board a common basis for those decisions including how we compare with peers, how much confidence to place in the information.”

IRIDX connects risk measurement and financial exposure to support underwriting and enable risk transfer for specific third-party relationships or contracts. Enterprises and insurance brokers can compare IRFE estimates with relevant insurance coverage and contractual recovery provisions to inform decisions about reducing, retaining or transferring exposure. Underwriters can use the IRIDX Score, evidence confidence and IRFE to inform decisions about a specific relationship. Insurers independently determine coverage, limits, retentions, pricing and terms. The IRIDX Score could also provide a consistent reference for regulators considering policy or oversight, including patterns, concentrations and changes in information risk.

“The IRIDX Score provides a unique and compelling view of third-party relationship risk,” said Josh Ladeau, Managing Director of Strategic Initiatives at Trium Cyber. “This is perhaps our first opportunity, as an industry, to acquire genuine ‘criticality-of-vendor-relationship’ data, and that’s just one piece. Deeper evidentiary collection and analysis processes, along with normalized scoring, offer substantially greater confidence in structuring appropriate coverage and create a foundation for a contract-specific product like True Transfer.”

“Trium’s True Transfer, leveraging the IRIDX score, enables the policyholder to surgically insure vendor exposure at the point of contract, with ring-fenced limits. There’s nothing like it in the market today, and it drives confidence that there will be a check to cash when the bad day hits. Even with favorable contractual arrangements, the typical vendor breach fallout requires a lawsuit to access the vendor policy limits, which have also likely been previously committed many times over to every one of the vendor’s other clients as well.” said Matt Donovan, Executive Vice President at Amwins Group.

Operational Results and Measurement Credibility

IRIDX works with evidence organizations already collect and reduces manual interpretation and repeated review by normalizing varied evidence and identifying the inputs and gaps most relevant to the decision.

A comparative review found:

  • Median analyst review time decreased by 89%, from 5.3 hours under the existing process to 35 minutes with IRIDX.
  • Median elapsed time from evidence submission to completed risk determination decreased by 99.8%, from 14 days under the existing process to 35 minutes with IRIDX.
  • Median analyst labor cost for review under the existing process was approximately $850 per review, based on fully loaded analyst costs. IRIDX is saving organizations up to 80% per review.

These results are based on a comparative review using fully loaded analyst costs and comparable review scope; individual results vary.

The IRIDX Score and IRFE methodologies have undergone independent methodological review by Hubbard Decision Research. Trium Cyber has evaluated IRIDX for use in True Transfer, including the IRIDX Score as the primary input for underwriting decisions.

Patented methods supporting IRIDX address residual-risk modeling and threat-driven adaptation of control specifications; additional methods are patent pending.

IRIDX is now generally available.

Visit IRIDX.com to learn more and to request a demonstration.

About IRIDX

IRIDX, a HITRUST Company, is an information risk ratings company that develops and governs standardized methods and measures for residual information risk and related financial exposure. Its measures support third-party information risk management, enterprise governance, benchmarking, insurance underwriting and risk transfer. IRIDX and HITRUST are separate companies that share a common founder, Daniel Nutkis; IRIDX governs its methodologies and scoring independently of HITRUST. Learn more at IRIDX.com.

About HITRUST

HITRUST is the industry leader in cybersecurity assurance, cyber risk management and ecosystem trust. HITRUST CSF harmonizes more than 70 authoritative information security, privacy, and AI control standards and frameworks, continuously adapted to keep pace with the latest threats, into the gold-standard cybersecurity framework. Defensible assurance is delivered by independent validation through over 100 assessor partners, centralized quality control, standardized certification and reporting, and a powerful platform. Organizations across industries use HITRUST for third-party risk management, cyber risk management, information protection, digital trust, and compliance. According to HITRUST’s 2026 Trust Report, 99.62% of HITRUST-certified environments did not report a breach in 2025. For nearly 20 years, HITRUST has set the standard for trusted cybersecurity, enabling teams to manage and reduce risk with consistency and efficiency at scale so organizations can operate confidently and securely. Learn more at HITRUSTalliance.net.

Media Contact

Tony Welz
W2 Communications
[email protected]

SOURCE HITRUST Services LLC