HITRUST Launches IRIDX to Measure Cyber Risk and Financial Exposure

HITRUST has launched a new company called IRIDX to tackle a longstanding problem in cybersecurity: Organizations have spent years collecting risk assessments, certifications and other security evidence without a consistent way to measure how much risk remains or what that exposure could cost them.

Announced Tuesday, Oct. 27, IRIDX is an information risk ratings company designed to establish standardized methods for measuring residual information risk and estimating its financial consequences. The company aims to give security leaders, corporate boards, insurers and regulators a common basis for evaluating risk and making decisions about which exposures to reduce, accept or transfer.

The launch marks an expansion beyond HITRUST's traditional focus on cybersecurity assurance and certification into standardized risk measurement and financial modeling.

"You cannot govern what you cannot consistently measure," said Daniel Nutkis, founder and executive chairman of HITRUST and founder of IRIDX. "Financial markets rely on standardized measures of credit risk because consequential decisions require a common basis for comparison. Information risk has lacked that same foundation."

Why HITRUST is launching a separate company

The problem IRIDX is designed to address is not a shortage of cybersecurity data. It is the difficulty of translating that data into consistent, comparable measures that executives can use to make business decisions.

Organizations routinely collect security questionnaires, certifications, assessments, telemetry and external risk signals from vendors and business partners. But those inputs vary in quality, scope and reliability, making it difficult to determine whether two organizations with different evidence profiles represent comparable levels of risk.

That challenge becomes particularly important when companies must evaluate their third-party relationships, determine whether exposure falls within acceptable thresholds or decide how much insurance coverage they need.

IRIDX is intended to provide a common measurement framework that connects security evidence with residual risk and potential financial losses.

The new company builds on nearly two decades of HITRUST's work developing cybersecurity controls, assurance methodologies and threat-informed assessments. However, IRIDX and HITRUST are separate companies that share a common founder. IRIDX will govern its scoring and measurement methodologies independently of HITRUST's certification programs.

The distinction is central to the new company's positioning. IRIDX is not introducing another cybersecurity certification. Instead, it will evaluate existing evidence from multiple sources and translate it into standardized risk measures.

Turning cybersecurity evidence into financial exposure

IRIDX is launching with two principal measures: the IRIDX Score and Information Risk Financial Exposure (IRFE).

The IRIDX Score measures residual information risk, identifies factors contributing to the result and indicates how much confidence organizations should place in the underlying evidence. It is designed to help distinguish actual security weaknesses from gaps or uncertainty in available information.

IRFE takes that measurement further by incorporating service relationships, contractual terms and business-impact information to estimate potential financial exposure.

The resulting estimates provide low, base and high scenarios for modeled gross financial exposure associated with a particular business relationship. Those figures are calculated before accounting for insurance, indemnification or other mechanisms that could offset losses.

The company also offers governance and benchmarking capabilities intended to help organizations compare exposures across vendors, identify concentrations of risk and evaluate whether those exposures fall within approved risk thresholds.

"IRIDX bridges the gap between cybersecurity risk and business decision-making, giving executives and boards a consistent, defensible basis to understand their financial exposure, prioritize risk reduction and make informed decisions about what risk to accept, retain or transfer," said Gregory Webb, CEO of HITRUST.

Third-party risk and cyber insurance applications

A major focus of the new company is third-party risk management, where organizations often struggle to connect vendor security reviews with the financial consequences of a potential incident.

IRIDX's measurements are designed to support both enterprise risk governance and insurance underwriting, allowing organizations to evaluate the exposure associated with specific vendors, services and contracts.

Trium Cyber has evaluated IRIDX for use in its True Transfer insurance offering, with the IRIDX Score serving as a primary underwriting input. The approach is intended to support insurance coverage tailored to individual vendor relationships rather than relying exclusively on broader enterprise cyber insurance policies.

Insurers will continue to independently determine policy pricing, limits, coverage and terms.

The company is also positioning its standardized measurements as potentially useful to regulators evaluating patterns and concentrations of information risk.

Company reports major reductions in review time

HITRUST also released comparative review results suggesting IRIDX could significantly reduce the time required to evaluate third-party security evidence.

According to the company, median analyst review time declined 89%, from 5.3 hours to 35 minutes, while median elapsed time from evidence submission to completed risk determination fell 99.8%, from 14 days to 35 minutes.

HITRUST also reported potential labor cost savings of up to 80% per review, compared with an existing process carrying a median analyst labor cost of approximately $850.

The company said the comparison used similar review scopes and fully loaded analyst costs, and that individual results may vary. The release does not provide the sample size or detailed testing methodology behind those performance figures.

The IRIDX Score and IRFE methodologies have undergone an independent methodological review by Hubbard Decision Research, according to the announcement.

A new approach to measuring information risk

The launch comes as artificial intelligence increases both the volume of security evidence available to organizations and the complexity of the threats they must evaluate.

IRIDX's approach is designed to assess what that evidence actually demonstrates, how reliable it is and how it affects the amount of risk an organization continues to carry.

For HITRUST, the move represents an effort to extend cybersecurity assurance into a broader system of standardized risk measurement, one that could connect security operations with financial governance, vendor contracting and insurance decisions.

Whether those measures gain widespread acceptance among enterprises, insurers and regulators remains to be seen.

IRIDX is now generally available, with additional information at IRIDX.com.