HITRUST Launches New Risk Rating Firm IRIDX

The newly formed company provides standardized methods to measure residual information risk and financial exposure.

Updated on Oct. 27, 2026 in Cybersecurity

Isometric editorial illustration of a steel beam on a plinth, representing standardized data frameworks. — HITRUST has launched IRIDX, a new risk ratings firm intended to provide standardized methodologies for measuring information security and financial exposure. AI Illustration. Upload story photo >

Live Poll

Do you believe standardized industry risk ratings improve corporate information security and financial governance?

HITRUST has officially launched a new information risk ratings company called IRIDX. This firm focuses on providing standardized methodologies to quantify residual information risk and estimate potential financial exposure for organizations.

Why it matters

The venture aims to provide a common foundation for information risk decisions that are necessary for enterprises, boards, underwriters, and regulators. By creating uniform metrics, the company helps stakeholders better understand their security posture.

IRIDX utilizes specialized protocols to convert assurance and risk evidence into standardized measures of residual information risk. These methods allow for the quantification of financial exposure across diverse enterprise governance structures.

The players

HITRUST

HITRUST is a standards development organization that provides security and privacy frameworks for various industries.

IRIDX

IRIDX is an information risk ratings company based in Frisco, Texas, focused on financial and security risk quantification.

The details

IRIDX is designed to integrate assurance evidence into a clear framework for risk governance. It addresses the growing need for objective data points when assessing organizational vulnerabilities.

October 27, 2026: HITRUST announced the launch of IRIDX.

The Tech Race

This development represents a shift toward the quantification of cybersecurity, replacing subjective risk assessments with data-driven financial modeling. It positions IRIDX as a critical standard-bearer in an industry previously defined by fragmented security reporting.

For local businesses in Frisco, this tool offers a more precise way to communicate security risks to underwriters and board members. It simplifies compliance reporting by providing a clear, standardized score for potential financial exposure.

The takeaway

Standardizing how companies measure information risk is becoming essential for modern financial oversight. Organizations should evaluate how these new rating metrics could impact their existing cybersecurity insurance and risk management protocols.