Technical evaluation

vCISO Lite versus Riskonnect

Riskonnect is a PE-owned (TA Associates majority investor) enterprise integrated-risk-management platform — 2,700+ customers, ~24 modules across GRC, insurable risk, business continuity, and AI governance, Salesforce-native at the core, with Monte Carlo and financial-impact analysis marketed on the Intelligent Risk / IT Risk pages. vCISO Lite runs cyber risk quantification and TPRM inside a broader vCISO + GRC + services platform from $299/mo— with a published FAIR Monte Carlo engine + Loss Exceedance Curves, a productized M&A cyber diligence service, an externally-anchored evidence chain, and risk operations your own AI agents can call via MCP.

Prepared: 2026-09-16
Method: Capability walk against Riskonnect’s published product surface (riskonnect.com, riskonnect.com/intelligent-risk/, riskonnect.com/it-risk-management-software/, riskonnect.com/riskonnect-platform-technology/, riskonnect.com/services/api-integration-services/, riskonnect.com/integrations/) and vCISO Lite’s live platform.
Sources: riskonnect.com, riskonnect.com/intelligent-risk/, riskonnect.com/it-risk-management-software/, riskonnect.com/riskonnect-platform-technology/ (Independent Certifications), riskonnect.com/services/api-integration-services/, riskonnect.com/integrations/, Feb 3 2026 Intelligent Risk Framework on Agentforce 360 press release, Argos Risk partnership release (April 2024), Redhand Advisors 2026 RMIS Report, vcisolite.com/pricing, vcisolite.com/diligence, vcisolite.com/evidence-graph, vcisolite.com/briefs-and-specs. See §10.
Corrections: Both vendors invited to review. Send corrections to /contact; the “Prepared” date above is bumped on any material update.

On this page · 10 sections

TL;DR

Findings§1

Where Riskonnect leads

Enterprise scale. 2,700+ customers including Arrow Electronics, RELX, Kohler, Wendy’s, Boston Scientific, Pure Storage, Southwest Airlines, Kaiser Permanente, Schlumberger, US Army; Riskonnect boilerplate names 1,500+ risk management experts (/company page says 2,000+). ~$231M ARR per third-party aggregators (not Riskonnect-sourced). Multi-billion-dollar procurement footprint vCISO Lite doesn’t touch.
Multi-domain risk platform. Four solution families (GRC, Insurable Risk, Business Continuity & Resilience, AI Governance) across ~24 modules including ERM, Compliance, Policy, ESG, Internal Audit, IT Risk, TPRM, Health & Safety, Claims Management, RMIS (Ventiv acquisition), BCM (Castellan acquisition), Crisis Management, Threat Intelligence, Active Risk Manager (Sword acquisition). Buyers looking for one platform for cyber + ops + ESG + HR + claims can get it here.^[9]
Monte Carlo + financial-impact marketing. Intelligent Risk page markets Monte Carlo simulations that model likelihood and impact of risks; IT Risk page calculates potential financial impact of security incidents. FAIR named as framework support. No published FAIR engine with Loss Exceedance Curves on the product surface.^[1]
Published certifications. ISO 27001, SOC 1 Type 2/ISAE 3402, SOC 2 Type 2, and HIPAA/HITECH on riskonnect.com/riskonnect-platform-technology/ Independent Certifications. (trust.riskonnect.com does not resolve.)^[7]
Redhand RMIS Leader nine years running. Insurance-industry analyst placement vCISO Lite doesn’t hold. (Origami Risk beat them for #1 in the 2026 report; still a Leader placement.)
Intelligent Risk Framework on Agentforce 360. Announced Feb 3, 2026 — biggest platform play of the year. Salesforce enterprise-AI integration for buyers already deep in the Agentforce environment.
Embedded Argos Risk integration (April 2024). Continuous vendor intelligence surfaced via the embedded Argos Risk partnership (“Riskonnect and Argos Risk Partner to Bring Continuous Vendor Intelligence…”) — a real capability inside Riskonnect’s TPRM surface.^[6]
Salesforce-native core. ERM / GRC / Compliance / Policy / TPRM / AI-Gov modules run on Force.com; buyers already standardized on Salesforce get platform-consistent tooling and identity, workflow, and data-model reuse.

Where vCISO Lite leads

FAIR engine + Loss Exceedance Curves, shipped. Riskonnect’s Intelligent Risk page markets Monte Carlo simulations and its IT Risk page markets financial-impact analysis — but no published FAIR engine with Loss Exceedance Curves or per-control what-if quantification on the product surface. vCISO Lite ships a 10,000-iteration seed-deterministic FAIR Monte Carlo engine with per-control what-if (the FAIR-CAM primitive), ALE, LEC, and NPV output on every scenario.^[1][2]
Productized M&A cyber diligence. QCD 5-pillar CCOD (Attack Surface, Third-Party Concentration, Data Sensitivity, Program Maturity, Integration) as a 72-hour deliverable defensible at the Investment Committee. Codified from Someone Else’s Debt (Yolonda Smith, 2026). Riskonnect has no M&A diligence surface.^[3]
Direct MCP endpoint for your own AI agent stack. APRI at mcp.vcisolite.com exposes per-control what-if, top-risk retrieval, scenario simulation, and Loss Exceedance Curve retrieval to any MCP-speaking client. Riskonnect’s Intelligent Risk Framework runs inside Salesforce’s Agentforce 360 and its Standard APIs are documented on /services/api-integration-services/ (REST), but no MCP server — external Claude / Cursor / custom LLMs integrate via Agentforce or REST, not an MCP endpoint directly.^[4]
Externally-anchored evidence chain. Every risk artifact Ed25519-signed and anchored to an external RFC-3161 timestamp authority. A SOC 2 auditor, cyber-insurance carrier, or M&A diligence reviewer can prove the chain wasn’t tampered with, without trusting vCISO Lite. Riskonnect’s audit trail sits inside the Salesforce data layer with no external anchor or transparency log disclosed. SDK-licensable since 2026-08-15.^[5]
Named framework breadth including NYDFS 500, PCI DSS, Basel, MAS TRM, OSFI B-13. Riskonnect’s public pages name DORA, SOX, APRA CPS 230, NIST 800-53, NIST CSF, ISO 27001, COBIT, FAIR; HIPAA, SOX, GLBA, FedRAMP (IT Risk FAQ); GDPR + DORA (TPRM/AI-gov). Not surfaced: NYDFS Part 500, PCI DSS, Basel, MAS TRM, OSFI B-13. vCISO Lite’s 250+ SCF-cross-mapped frameworks (catalog on every plan; active assessment caps vary by tier per /pricing) include all five.^[8]
Published pricing from $299/mo ($3,228/yr billed annually) at /pricing. Riskonnect is enterprise-sales-led; third-party aggregator estimates (not Riskonnect-sourced; competitor-blog + benchmark-aggregator sources) land $150K-$500K+ Year 1 for TPRM-only mid-market, or ~$400K first-year TCO all-in. Treat as directional.^[10]
Trustworthy Autonomy proven in production. Public beta since 2026-07-07; Level 1 agent governance proven in production 2026-08-17. Riskonnect’s Intelligent Risk Framework on Agentforce 360 is thought-leadership plus platform integration; no published evaluation harness grading the agent by task category before purchase.
Founder-direct. [email protected] reaches the founder, not a sales-development queue.

Scope & evaluation criteria

Boundaries§2

In scope

Buyer profile: CISOs, CROs, and CFOs comparing an enterprise multi-domain IRM platform (Riskonnect) against cyber + GRC + services on a narrower SKU (vCISO Lite). Especially useful for buyers who need a published FAIR engine with Loss Exceedance Curves (not just Monte Carlo marketing + FAIR-named framework support), a direct MCP endpoint for their own agent stack (not Agentforce 360 or REST), or a productized M&A cyber diligence deliverable.
Evaluation frame: Ten capability categories the enterprise risk buyer typically weighs — FAIR engine with LEC published, per-control what-if primitive, M&A cyber diligence, MCP-callable risk operations, evidence integrity foundation, native vendor scanning, own trust posture, named framework breadth, multi-domain risk breadth, published pricing. Not: everything each vendor does.
Comparison basis: Riskonnect’s published product surface (riskonnect.com, riskonnect.com/intelligent-risk/, riskonnect.com/it-risk-management-software/, riskonnect.com/riskonnect-platform-technology/, riskonnect.com/services/api-integration-services/, riskonnect.com/integrations/), Feb 3 2026 Intelligent Risk Framework on Agentforce 360 press release, Argos Risk partnership release (April 2024), Redhand Advisors 2026 RMIS Report. vCISO Lite’s live platform. Not: NDA material, unreleased roadmap, or third-party analyst reports behind paywalls.

Out of scope

Insurable Risk / RMIS / Claims: Riskonnect’s Insurable Risk family (5 modules including Claims Management and RMIS from the Jan 2024 Ventiv acquisition) targets insurance carriers and self-insured enterprises. vCISO Lite doesn’t compete in this category. If the buyer needs unified GRC + Claims + RMIS on one platform, Riskonnect is the right choice.
Business Continuity & Resilience (Castellan): Riskonnect’s BCM family (5 modules including Castellan-origin BCM, Operational Resilience, Crisis Management, Threat Intelligence, Emergency Notification) is a distinct product category. vCISO Lite doesn’t compete in BCM as a standalone; buyers needing dedicated BCM alongside cyber should evaluate Castellan-inside-Riskonnect or Fusion Risk Management.
Enterprise Salesforce standardization: Riskonnect’s GRC / TPRM / Compliance / Policy / AI-Gov core is Salesforce-native. Buyers already deep in Salesforce (Force.com, Agentforce 360, Data Cloud) get platform-consistent identity, workflow, and data-model reuse. vCISO Lite runs multi-tenant SaaS outside the Salesforce environment — different foundation assumption.

Capability coverage

Ten capabilities§3

Amber = Riskonnect ships / has it. Teal = vCISO Lite ships it. Split = both. Hover a hex for the mechanism detail.

Capability

FAIR engine + Loss Exceedance Curves (published)^[1]

Riskonnect markets Monte Carlo simulations and financial-impact analysis but doesn't publish a FAIR engine with Loss Exceedance Curves. vCISO Lite ships a seed-deterministic FAIR Monte Carlo engine with LEC on every scenario.

Riskonnect: Riskonnect's Intelligent Risk page markets 'Monte Carlo simulations that model likelihood and impact of risks' and the IT Risk Management page 'calculates the potential financial impact of security incidents' — plus FAIR, NIST 800-53, NIST CSF, ISO 27001, COBIT named as framework support. What's not published on the product surface: a FAIR engine with full Loss Exceedance Curves, ALE percentile bands, or per-control what-if quantification.
vCISO Lite: 10,000-iteration seed-deterministic Monte Carlo engine. Every simulation reproducible for audit — identical inputs produce identical outputs. Output includes ALE (Expected), BestCase / Severe / Worst percentile bands, and a full Loss Exceedance Curve on every scenario and every per-control what-if.

vCISO Lite ships it
Riskonnect ships it
Both
Neither

Capability deep-dives

How each side implements it§4

Five capabilities, one spec-card per side. Framework decomposition lives in §5.

Four solution families ride on a Salesforce-native core plus acquired acquired stacks (Sword, Ventiv, Castellan), with the Intelligent Risk Framework agentic layer running on Agentforce 360.

§4.1

FAIR engine + Loss Exceedance Curves (published)

Riskonnect markets Monte Carlo and financial-impact analysis. vCISO Lite publishes a FAIR Monte Carlo engine with Loss Exceedance Curves.

Riskonnect

The Intelligent Risk page markets 'Monte Carlo simulations that model likelihood and impact of risks'; the IT Risk Management module 'calculates the potential financial impact of security incidents' and names FAIR + NIST 800-53 + NIST CSF + ISO 27001 + COBIT as supported frameworks. No published FAIR engine with Loss Exceedance Curves, ALE percentile bands, or per-control what-if quantification on the product surface.

Inputs: Risk scenarios, control assessments, and framework mappings inside the ERM / IT Risk modules.
Outputs: Monte Carlo simulations, heat maps, bowties, role-based ERM dashboards, financial-impact figures, PDF/CSV exports. No published LEC curves or per-control what-if ALE.
Evidence: riskonnect.com/intelligent-risk/ ('Monte Carlo simulations') and riskonnect.com/it-risk-management-software/ ('potential financial impact of security incidents'); no LEC or per-control FAIR output on the surface.
Fails when: Buyer needs a published Loss Exceedance Curve for cyber-insurance underwriting conversations, or per-control what-if that quantifies how a specific control impacts ALE for a specific loss event. Monte Carlo + financial-impact marketing is there; LEC + per-control what-if isn't.

vCISO Lite

10,000-iteration seed-deterministic Monte Carlo engine. Every simulation is reproducible for audit — identical inputs produce identical outputs.

Inputs: Scenario definition from the risk register; frequency low/high; magnitude low/high; control effectiveness; optional per-control what-if frequency and magnitude reductions.
Outputs: Baseline and projected ALE with percentile bands, full Loss Exceedance Curve, ALE reduction in dollars and percent, ROI (NPV, payback years, 10% discount, 3-year model).
Evidence: Trial count engineered for sub-30-second per-org runtime across the risk register. Every simulation Ed25519-signed to the Evidence Graph.
Fails when: Buyer's procurement requirement is a Forrester Wave CRQ Leader analyst cite specifically. Neither Riskonnect nor vCISO Lite currently holds that placement (Safe Security is the Q2 2025 Wave Leader).

§4.2

Per-control what-if (FAIR-CAM primitive)

Riskonnect names FAIR but doesn't publish the per-control quantification mechanic. vCISO Lite ships it in production and exposes it to external agents through APRI.

Riskonnect

Per-control quantification — how a specific control's frequency reduction and magnitude reduction shift ALE for a specific loss event — is not surfaced as a distinct primitive on any public product page.

Inputs: Control assessments and framework mappings inside the IT Risk Management module.
Outputs: Heat-map placement, control-effectiveness ratings, framework coverage rollups.
Evidence: riskonnect.com/it-risk-management-software/ names FAIR as framework support; no per-control what-if primitive published.
Fails when: Buyer needs to answer 'what does this control at maturity Z do to my ALE for this specific loss event?' as a dollar figure. That's FAIR-CAM's definitional question; not Riskonnect's shape today.

vCISO Lite

Per-control frequency reduction × magnitude reduction re-runs the target scenario through the same 10,000-iteration Monte Carlo engine. Callable from any MCP-speaking agent through APRI.

Inputs: Target scenario or risk name; the control's frequency reduction and magnitude reduction (0–1 fractions); optional implementation cost and annual cost for ROI computation.
Outputs: Baseline and projected numbers side-by-side: Expected (ALE), BestCase, Severe, Worst, and full Loss Exceedance Curve. Plus ALE reduction in dollars and percent, and ROI (NPV, payback years, 10% discount, 3-year model).
Evidence: Every invocation Ed25519-signed to the Evidence Graph. This is FAIR-CAM's definitional statement: quantify how a specific control impacts loss event frequency and loss magnitude.
Fails when: Buyer's requirement is the Forrester Wave FAIR-CAM analyst cite specifically today. Safe Security holds that; the analyst-positioning work is on the roadmap.

§4.3

M&A cyber diligence as productized SKU

Riskonnect has no M&A cyber diligence surface. vCISO Lite ships QCD 5-pillar CCOD as a 72-hour productized service.

Riskonnect

Enterprise IRM across GRC + Insurable Risk + BCM + AI Governance is Riskonnect's platform. M&A cyber diligence as a productized deliverable is not a Riskonnect surface. Deal-side buyers doing PE/M&A cyber diligence engage big-four services or specialist boutiques.

Inputs: N/A — no diligence product on public surface.
Outputs: N/A.
Evidence: Public product surface has no /diligence, /qcd, or M&A-diligence-branded page.
Fails when: Buyer is deal-team-side (PE, M&A) needing pre-close cyber diligence delivered in days, not weeks, defensible at Investment Committee.

vCISO Lite QCD

Quantitative Cyber Diligence — 5-pillar CCOD (Attack Surface, Third-Party Concentration, Data Sensitivity, Program Maturity, Integration) productized at /diligence. 72 hours from kickoff to a deliverable defensible at the Investment Committee.

Inputs: Target company scope + engagement letter · public attack-surface data · contracts and vendor list where accessible · framework attestations.
Outputs: Single-figure CCOD (Cyber Cost of Deal) with per-pillar decomposition · defensible narrative for the IC · portable format (ephemeral by design).
Evidence: Codified from Someone Else's Debt (Yolonda Smith, 2026). Published pillar-by-pillar on /diligence.
Fails when: N/A on the diligence axis — Riskonnect has no comparable productized diligence surface.

§4.4

Direct MCP endpoint for external agent stacks

Riskonnect's Intelligent Risk Framework runs inside Salesforce Agentforce 360 and Standard REST APIs are documented, but no MCP server. vCISO Lite exposes risk operations as MCP tools any external agent can invoke directly.

Riskonnect

Intelligent Risk Framework on Agentforce 360 (announced Feb 3, 2026) is Riskonnect's biggest platform play. It runs inside Salesforce's agent runtime. Riskonnect also documents Standard APIs on /services/api-integration-services/ (REST). No MCP server published; external Claude / Cursor / partner agents integrate via Agentforce or REST.

Inputs: User interactions and agent flows inside the Agentforce 360 / Salesforce environment, or REST calls against documented endpoints.
Outputs: Displayed inside the Riskonnect + Salesforce platform; exportable through Salesforce; REST payloads for integrators.
Evidence: Feb 3 2026 press release names Agentforce 360 as the agentic layer; riskonnect.com/services/api-integration-services/ documents Standard APIs; no MCP server found.
Fails when: Buyer's team lives in Claude / Cursor / a custom LLM outside the Salesforce environment and wants a direct MCP endpoint without a Salesforce or REST intermediary. Or an autonomous agent needs to invoke controls-what-if continuously via MCP.

vCISO Lite APRI

APRI at mcp.vcisolite.com exposes CRQ operations as callable MCP tools. Any Claude, Cursor, custom LLM, or autonomous loop can invoke per-control what-if, top-risk retrieval, scenario simulation, and Loss Exceedance Curve retrieval directly.

Inputs: Whatever context the invoking agent has — scenario ID, control candidate, risk threshold, workflow step from another MCP server.
Outputs: Same projection, delta, and ROI response the platform returns. Every invocation Ed25519-signed to the Evidence Graph regardless of which agent called it.
Evidence: Three architectural guarantees make composability safe: caller-entitlement scoped (invoking user's entitlements, not a service account), complete tool-call audit trail (Ed25519 on the Evidence Graph), observe-first (writes go through a confirmation gate). Published foundation-model choice (Anthropic Claude family).
Fails when: Buyer is already fully standardized on Salesforce Agentforce 360 and prefers all agent work to flow through the Salesforce environment. That's Riskonnect's foundation strength.

§4.5

Named framework breadth

Riskonnect's public pages name DORA, SOX, APRA, NIST, ISO 27001, COBIT, FAIR, HIPAA, GLBA, FedRAMP, GDPR. vCISO Lite names 250+ frameworks including a handful Riskonnect's public pages don't surface.

Riskonnect

IT Risk Management page names NIST 800-53, NIST CSF, ISO 27001, COBIT, FAIR. IT Risk FAQ names HIPAA, SOX, GLBA, FedRAMP. TPRM page names DORA and GDPR; AI Governance page names GDPR. Financial services page names DORA, SOX, APRA CPS 230, Bank of England. Compliance story is per-page named-framework rather than a central catalog.

Inputs: Framework mappings inside each module.
Outputs: Framework coverage rollups per module, ERM dashboard rollup.
Evidence: Riskonnect public pages surveyed (riskonnect.com/it-risk-management-software/, /third-party-risk-management-software/, /ai-governance/, Financial Services). NOT found on public pages: NYDFS Part 500, PCI DSS, Basel, MAS TRM, OSFI B-13.
Fails when: Buyer needs explicit coverage of NYDFS 500, PCI DSS, Basel, MAS TRM, or OSFI B-13 — not surfaced on Riskonnect's public pages; would require scoping-call confirmation.

vCISO Lite

250+ SCF-cross-mapped frameworks (1,468 universal controls) — every SCF-mapped control unlocks the frameworks that share it.

Inputs: SCF (Secure Controls Framework) crosswalk applied to every control in the corpus.
Outputs: Framework coverage per control, gap analyses, cross-framework harmonization for shared controls.
Evidence: Full framework list on /features/compliance. Includes NYDFS 500, PCI DSS, HIPAA, GDPR, CCPA/CPRA, GLBA, NIS 2, EU AI Act, ISO 42001, NIST AI RMF, CMMC L1-L3, FedRAMP, StateRAMP, TX-RAMP — every framework Riskonnect's public pages leave unmentioned.
Fails when: Buyer needs a specific niche insurance-industry framework (RIMS-CRO Standard, etc.) that Riskonnect's Insurable Risk family covers via Ventiv's RMIS lineage. That's Riskonnect's ceded ground.

Framework & control coverage

Framework depth§5

Riskonnect names DORA, SOX, APRA CPS 230, NIST 800-53, NIST CSF, ISO 27001, COBIT, FAIR across IT Risk Management + Financial Services; HIPAA, SOX, GLBA, FedRAMP are named in the IT Risk FAQ; GDPR + DORA are named on the TPRM and AI Governance pages. Not surfaced on public pages: NYDFS 500, PCI DSS, Basel, MAS TRM, OSFI B-13. vCISO Lite ships 250+ SCF-cross-mapped frameworks in the catalog on every plan (1,468 universal controls; active assessment caps vary by tier per /pricing) — every SCF-mapped control unlocks the frameworks that share it.

Riskonnect^[8]

NIST CSF

NIST 800-53

ISO 27001

COBIT

FAIR

DORA

SOX

APRA CPS 230

HIPAA

GLBA

FedRAMP

GDPR

vCISO Lite

SOC 2

ISO 27001

HIPAA

PCI DSS

NIST CSF 2.0

CMMC L1

CMMC L2

CMMC L3

800-171r3

NIST 800-53

FedRAMP

NIST RMF

NIST AI RMF

SEC cyber

CIS Controls

GDPR

DORA

NYDFS 500

HITRUST

CJIS

NIS 2

EU AI Act

ISO 42001

ISO 27002

ISO 27701

ISO 22301

SOC 1

SOC 3

CCPA / CPRA

GLBA

StateRAMP

TX-RAMP

CIS Benchmarks

MITRE ATT&CK

NIST 800-63

NIST 800-172

FFIEC CAT

SWIFT CSCF

LGPD

PIPEDA

COPPA

FERPA

CIPA

CSA CCM

Pricing & delivery model

Enterprise sales-led vs published direct-buy§6

Riskonnect is 100% enterprise-sales-led with no public pricing. Third-party aggregator estimates (not Riskonnect-sourced; competitor-blog + benchmark-aggregator sources — treat as directional) land first-year TCO at ~$400K all-in and mid-market TPRM-only Year 1 at $150K–$500K+. vCISO Lite starts at $299/mo ($3,228/yr billed annually) Starter, with every tier price on /pricing.

Riskonnect

Enterprise SaaS

Contact-sales · no public dollar figure^[10]

Sold to: Fortune 500 / large-enterprise CROs, CFOs, CIOs — Arrow Electronics, RELX, Kohler, Kaiser Permanente, US Army, Southwest Airlines
Published tiers: None — contact-sales for pricing
Free-trial entry: No
Delivery model: Sales-led · demo-gated · enterprise implementation with services (third-party aggregator estimates — not Riskonnect-sourced — put first-year TCO around ~$400K all-in; treat as directional)
Sales cycle: Request-a-demo → scoping call → implementation SOW → contract

vCISO Lite

From $299/mo

Direct-buy from Starter · every tier on /pricing

Starter: $299/mo ($3,228/yr billed annually) — vendor + questionnaire assessment capacity at Starter per-month caps on /pricing. CRQ (Quantified Risk Analysis) begins at Business tier.
Platform + services: vCISO Lite ships the platform and productized services (QCD M&A cyber diligence, managed TPRM assessments) on /services.
Sales cycle: Direct-buy end-customer · Enterprise: one call, flat MSRP on file · no scoping-call gate to see a price

Integration surface

Native connectors§7

Riskonnect publishes an integrations catalog at riskonnect.com/integrations/ and documents 200+ existing integrations on /services/api-integration-services/; the Salesforce-native core also gets AppExchange breadth. vCISO Lite runs its own connector catalog outside the Salesforce environment. Full vCISO Lite catalog on /features/integrations.

Integration	Riskonnect	vCISO Lite
AWS	Native	Native
Azure	Native	Native
GCP	—	Native
Snowflake	—	Native
GitHub	—	Native
GitLab	—	Native
Google Workspace	—	Native
Microsoft 365	—	Native
Okta	—	Native
Jira	—	Native
Slack	—	Native
ServiceNow	—	Native
Tenable	Native	Native
OpenAI	Native	Native
MCP (Model Context Protocol)	—	Native
Salesforce / Force.com	Native	—
Salesforce Agentforce 360	Native	—
Mulesoft	Native	—
Argos Risk (vendor intelligence, embedded integration)	Native	—
Integration catalog published?	riskonnect.com/integrations/ (plus AppExchange) · 200+ existing integrations per API services page	Full catalog on /features/integrations

Deployment, data, extensibility

Platform architecture§8

Attribute	Riskonnect	vCISO Lite
Service model	SaaS multi-tenant · Salesforce-native core (GRC/TPRM/Compliance/Policy/IT Risk/AI-Gov) · Sword / Ventiv / Castellan on their own acquired stacks	SaaS multitenant · end-customer tenancy · Enterprise-tier isolated deployment on request
FAIR engine + Loss Exceedance Curves (published)	Markets Monte Carlo + financial-impact analysis on Intelligent Risk / IT Risk pages; FAIR named as framework support; no published LEC or per-control FAIR output	10,000-iteration seed-deterministic Monte Carlo · ALE percentile bands + full LEC on every scenario · reproducible for audit · every simulation Ed25519-signed to the Evidence Graph
Per-control what-if (FAIR-CAM primitive)	Not surfaced on public product pages	Per-control frequency reduction × magnitude reduction re-run through the same engine · ALE reduction in dollars + NPV + LEC delta · callable from any MCP-speaking agent through APRI
M&A cyber diligence surface	Not on public product surface	QCD 5-pillar CCOD productized at /diligence · 72-hour deliverable · defensible at the IC
Audit-trail model	Salesforce-native data layer (core modules) · Sword / Ventiv / Castellan on their own stacks · no external anchor / per-event signing / transparency log disclosed	Evidence Graph · per-event Ed25519 signing · RFC 3161 external timestamp anchor · SDK-licensable
Where the AI actually runs	Intelligent Risk Framework on Salesforce Agentforce 360 · inside the Salesforce environment · Standard APIs (REST) documented on /services/api-integration-services/ · no MCP server	Callable from any MCP-speaking client via APRI at `mcp.vcisolite.com` · every invocation Ed25519-signed to Evidence Graph
Vendor intelligence (continuous)	Embedded Argos Risk integration (announced April 2024)	Engagement-driven (red-team / QCD / DC-TPIR), not always-on rating engine
Multi-domain risk breadth	~24 modules across GRC + Insurable Risk + BCM + AI Gov	Cyber + GRC + TPRM + DC-TPIR + M&A diligence — narrower
Analyst pedigree	Redhand Advisors 2026 RMIS Report Leader (9th consecutive year)	No CRQ-category or IRM-category analyst-cite today
Own compliance posture	ISO 27001 · SOC 1 Type 2 / ISAE 3402 · SOC 2 Type 2 · HIPAA/HITECH on `riskonnect.com/riskonnect-platform-technology/` Independent Certifications · `trust.riskonnect.com` does not resolve · also inherits underlying Salesforce compliance stack	SOC 2 Type II · ISO 27001 · posture published on /about

Notes & sources

Provenance§10

[1] Riskonnect Intelligent Risk page markets “Monte Carlo simulations that model likelihood and impact of risks” (riskonnect.com/intelligent-risk/) and the IT Risk Management module “calculates the potential financial impact of security incidents” and names FAIR, NIST 800-53, NIST CSF, ISO 27001, COBIT as framework support (riskonnect.com/it-risk-management-software/, accessed 2026-10-08; replaces the 404’d /products/it-risk-management URL). No published FAIR engine with Loss Exceedance Curves, ALE percentile bands, or per-control what-if quantification on the product surface. vCISO Lite ships a 10,000-iteration seed-deterministic Monte Carlo engine with ALE percentile bands and LEC on every scenario.
[2] Per-control what-if (FAIR-CAM primitive). Not surfaced on Riskonnect’s public product pages. vCISO Lite ships per-control frequency reduction × magnitude reduction re-run through the same Monte Carlo engine, returning ALE reduction in dollars, NPV, payback, and Loss Exceedance Curve delta. Callable from any MCP-speaking agent through APRI.
[3] QCD 5-pillar CCOD (Cyber Cost of Deal) productized as M&A cyber diligence service from vcisolite.com/diligence. Methodology codified in Yolonda Smith’s 2026 book Someone Else’s Debt.
[4] Riskonnect Intelligent Risk Framework on Agentforce 360 announced Feb 3, 2026 (Riskonnect press release). Riskonnect also documents Standard APIs on riskonnect.com/services/api-integration-services/ (REST) and references “200+ existing integrations”; no MCP server found. vCISO Lite APRI (MCP tool graph exposing per-control what-if, top-risk retrieval, scenario simulation, and Loss Exceedance Curve retrieval; live at mcp.vcisolite.com) verified against vcisolite.com/titanium.
[5] vCISO Lite Evidence Graph (per-event Ed25519 signing shipped 2026-08-16 + RFC-3161 external timestamp anchor + transparency log live in production 2026-08-20; SDK-licensable since 2026-08-15) from vcisolite.com/evidence-graph. Riskonnect audit-trail characteristics from Riskonnect product pages (Salesforce-native data layer for core; Sword / Ventiv / Castellan on their own stacks; no external anchor / per-event signing / transparency log disclosed).
[6]Riskonnect + Argos Risk integration announced April 2024 (“Riskonnect and Argos Risk Partner to Bring Continuous Vendor Intelligence…”, Riskonnect press page); framed as an embedded integration, not an OEM arrangement.
[7] Riskonnect own trust posture: riskonnect.com/riskonnect-platform-technology/ Independent Certifications section publishes ISO 27001, SOC 1 Type 2 / ISAE 3402, SOC 2 Type 2, and HIPAA/HITECH as of 2026-10-08. trust.riskonnect.com does not resolve. Underlying Salesforce compliance stack (FedRAMP, SOC 1/2, ISO 27001) is Salesforce’s program; the certifications above are Riskonnect’s own. vCISO Lite SOC 2 Type II + ISO 27001 posture published on vcisolite.com/about.
[8] Riskonnect explicitly-named frameworks: NIST 800-53, NIST CSF, ISO 27001, COBIT, FAIR (IT Risk Management); HIPAA, SOX, GLBA, FedRAMP (IT Risk FAQ); DORA, GDPR (TPRM); GDPR (AI Governance); DORA, SOX, APRA CPS 230, Bank of England (Financial Services). NOT surfaced on public pages: NYDFS Part 500, PCI DSS, Basel, MAS TRM, OSFI B-13. vCISO Lite framework coverage (250+ SCF-cross-mapped, 1,468 universal controls in catalog on every plan; active assessment caps vary by tier per /pricing) verified against vcisolite.com/features/compliance.
[9] Riskonnect four solution families and ~24 modules from riskonnect.com (navigation + product pages — the legacy /products hub is deprecated). Acquisitions: Sword GRC (Feb-Apr 2022), Castellan (Jul 2022), Ventiv Technology (Jan 11, 2024). Headcount per own pages conflicts (Argos boilerplate: 1,500+ risk management experts; /company: 2,000+). Revenue ~$231M ARR per third-party aggregators (PitchBook / ZoomInfo); not Riskonnect-sourced. 2,700+ customers per Argos boilerplate.
[10] Riskonnect pricing (100% sales-led; no public dollar figure). All quantitative Year 1 figures ($35K–$140K entry single module, ~$400K first-year TCO, $150K–$500K+ mid-market TPRM Year 1) are third-party aggregator estimates (competitor-blog and benchmark-aggregator sources, not Riskonnect-sourced); treat as directional. vCISO Lite platform tiers ($299/mo Starter / $3,228/yr billed annually through $8,500/mo Enterprise MSRP) from vcisolite.com/pricing.
All product capability claims for both platforms are current as of the “Prepared” date at the top of this page. If Riskonnect publishes a FAIR engine with Loss Exceedance Curves, a public MCP endpoint, or an externally-anchored evidence chain since publication, corrections at /contact.
This page compares Riskonnect (enterprise multi-domain IRM) against vCISO Lite (CRQ + GRC + services on a narrower SKU). It does not compare against other IRM platforms on their own merits — the buyer evaluating enterprise IRM should also see /vs/servicenow-irm. Dedicated CRQ specialists at /vs/safe-security, /vs/kovrr, and /vs/cybersaint.

vCvCISO Litevs versus Riskonnect

Make the case for vCISO Lite alongside Riskonnect

vCISO Lite versus Riskonnect