Frisco, Texas – October 27, 2026 -- HITRUST has launched IRIDX, an information risk ratings company whose comparative review showed median analyst review time falling 89%, from 5.3 hours to 35 minutes, and median time from evidence submission to completed risk determination falling 99.8%, from 14 days to 35 minutes.

IRIDX sets and governs standardized methods for measuring residual information risk and estimating related financial exposure. It targets enterprises, boards, underwriters and regulators that hold large volumes of assessments, certifications, questionnaires, telemetry and external risk signals but have no consistent way to compare them at scale.

IRIDX Score and IRFE convert assurance evidence into comparable measures

The IRIDX Score measures residual information risk and identifies the factors driving the result. An evidence-confidence indicator separates control weaknesses from evidence gaps or uncertainty. Authoritative Alignment Scores show alignment and gaps against specified regulatory, standards, supervisory and AI governance or security requirements.

Information Risk Financial Exposure (IRFE) combines the residual-risk and evidence-confidence signals with relationship-specific service, contract and business-impact data. It produces a scenario-based Low / Base / High range of modeled gross financial exposure for a defined relationship. The range is calculated before insurance, indemnity, contractual recovery or other transfer mechanisms. Visible assumptions and loss drivers tie each estimate to the relationship's business context.

IRIDX's Evidence Intelligence process evaluates each input to determine what it demonstrates and how reliably it supports a risk determination. Its methods are governed under a separate framework from HITRUST's assurance and certification programs, and apply the same criteria for evidence relevance, rigor and reliability regardless of source or affiliation.

"You cannot govern what you cannot consistently measure," said Daniel Nutkis, HITRUST's founder and executive chairman and the founder of IRIDX.

Boards gain portfolio views of vendor exposure against risk appetite

Management and boards can compare exposure against risk appetite and approved thresholds, track the proportion of vendors within tolerance, and identify material exceptions and concentrations across vendors, services and shared dependencies. Peer benchmarking and review-coverage metrics are intended to make gaps and uncertainty visible.

Jeff Schilling, CIO and CISO at TaskUs, said vendor management currently yields only a count of vendors reviewed, not the risk accepted or its concentration. TaskUs is not a current IRIDX client.

Mark Solomon, managing partner of Katten Muchin Rosenman's Dallas office, said IRIDX and IRFE could give clients a more consistent basis for negotiating protections and documenting risk acceptance in M&A and board settings.

Insurers tie underwriting to IRIDX Score through Trium Cyber's True Transfer

Underwriters can use the IRIDX Score, evidence confidence and IRFE to inform decisions on a specific relationship, while insurers independently set coverage, limits, retentions, pricing and terms. Enterprises and brokers can compare IRFE estimates with existing coverage and contractual recovery provisions. Regulators could also use the score as a reference for patterns, concentrations and changes in information risk.

Trium Cyber's True Transfer product leverages the IRIDX Score to insure vendor exposure at the point of contract with ring-fenced limits. Matt Donovan, executive vice president at Amwins Group, said typical vendor breach fallout requires a lawsuit to reach vendor policy limits, which are likely already committed to the vendor's other clients. Josh Ladeau, managing director of strategic initiatives at Trium Cyber, called the IRIDX data a first opportunity for the industry to obtain vendor-relationship criticality information.

HITRUST CEO Gregory Webb said IRIDX is meant to give executives and boards a defensible basis for deciding which third-party risk to accept, retain or transfer. IRIDX draws on nearly two decades of HITRUST work in cyber threat analysis and control development, and on breach rates reported in HITRUST's annual Trust Report.