RiskWatch
RiskWatch · Founded 1993 · Sarasota, Florida, USA
Unified incident workspace covering cyber, physical, breach notification, and investigation case management at a $99 per month entry tier.
Summary
RiskWatch ships a unified incident management workspace built on the same 40-plus framework library that powers the broader risk and compliance platform. The incident workspace covers cyber-incident handling aligned to NIST SP 800-61 r3 and ISO/IEC 27035-1:2023, physical incident logging aligned to OSHA 29 CFR 1904 (Form 300 + 300A + 301), workplace violence case workflow aligned to ASIS WVPI.1-2020, investigation case management with chain-of-custody handling, breach-notification regulatory-clock automation covering HIPAA 60-day individual notification under 45 CFR 164.404 plus state breach notification across 50 states plus DC plus 3 territories plus GDPR Article 33 72-hour reporting, and root-cause analysis with 5 Whys and Ishikawa fishbone diagram templates. The Standard tier at $99 per month is the only published entry price in this ranking that ships a unified cyber-plus-physical-plus-breach workspace; single-tenant deployment with customer-owned data residency is available at the Enterprise tier. RiskWatch is honest about its profile: it is a unified incident, risk, and compliance platform first and a pure-play SOAR or pure-play physical-security specialist second, with less depth than Splunk SOAR or Cortex XSOAR on SIEM-native correlation and less depth than Resolver or D3 on investigation case workflow. It earns first place on the weighted score because the unified workspace plus the breach-notification regulatory-clock library plus the $99/month entry tier fits the mid-market and growth-stage incident-programme brief better than any single specialist.
Strengths
- Only platform in this ranking that ships unified cyber-incident + physical-incident + breach-notification + investigation case management in one tenant
- Standard tier $99 per month is the only published entry price in this ranking; Professional $36K per year published; Enterprise quote-only
- Pre-built breach-notification regulatory-clock library covering HIPAA 45 CFR 164.404 (60 days), state breach notification across 50 states + DC + 3 territories (California 1798.82, New York SHIELD Act, Florida 501.171 30 days), and GDPR Article 33 (72 hours)
- NIST SP 800-61 r3 and ISO/IEC 27035-1:2023 pre-mapped incident-handling workflow with the lessons-learned step linked to the broader risk register
- OSHA 29 CFR 1904 workplace-incident logging with Form 300 + 300A + 301 export and electronic submission for high-hazard NAICS codes due March 2
- Investigation case management with chain-of-custody handling, evidence vault versioning, ethics-line intake, and 5 Whys + Ishikawa fishbone RCA templates
- 33-year operating history with US state, federal, and regulated-industry customers gives a stability story that VC-funded SOAR vendors cannot match
- Single-tenant deployment with customer-owned data residency at the Enterprise tier; relevant when the regulator (state Attorney General, HHS OCR, EU DPA) requires data-locality evidence on breach files
Weaknesses
- Not a SIEM-native SOAR at Splunk SOAR or Cortex XSOAR depth; high-volume alert triage SOCs running Splunk Enterprise Security or Cortex XDR will need to pair RiskWatch with the SIEM-native SOAR or accept lower correlation depth
- Not a pure-play physical-security or investigation specialist at Resolver or D3 depth; case-investigation workflow is solid but the ethics-line intake and the chain-of-custody export library is shallower than Resolver
- No mass-notification delivery surface at OnSolve depth; an active-assailant or severe-weather notification fan-out to 100,000+ recipients in under 60 seconds requires pairing with OnSolve, Everbridge, or AlertMedia
- Smaller SIEM and XDR integration count than Cortex XSOAR (750+ content packs) or Splunk SOAR (350+ integrations); a SOC with deep tool sprawl will need API work
- No native AI hyperautomation overlay at Swimlane Turbine or Cortex XSIAM depth; AI playbook drafting is newer and has a shorter learning curve
- Sub-100 G2 reviews in the security-incident-management cohort specifically; brand awareness in pure-play SOAR is lower than Splunk SOAR, Cortex XSOAR, and Tines
Mid-market or growth-stage organisations that run cyber + physical + breach-notification + investigation cases under one programme and want a unified workspace at a published price under $100 per month entry. Strong fit for healthcare networks, regional banks, state and local government agencies, federally-funded research nonprofits, and Tier-2 utilities where one team owns all four incident types.
Pure-cyber SOCs at Fortune 500 scale running 1M+ alerts per day on Splunk Enterprise Security or Cortex XDR; the SIEM-native SOAR (Splunk SOAR, Cortex XSOAR) wins that brief. Also a poor fit for organisations whose primary incident load is active-assailant or severe-weather mass notification at scale; OnSolve or Everbridge fits that brief better.
Key features
- Unified cyber + physical + breach-notification + investigation incident workspace
- NIST SP 800-61 r3 and ISO/IEC 27035-1:2023 pre-built incident handling workflow
- OSHA 29 CFR 1904 workplace incident logging with Form 300 + 300A + 301 export
- Breach-notification regulatory-clock automation (HIPAA 60 days + state + GDPR 72 hours)
- Investigation case management with chain-of-custody handling and evidence vault versioning
- Root-cause analysis templates (5 Whys, Ishikawa fishbone, fault tree)
- Cross-mapping engine that links each incident to the affected control framework
- ASIS WVPI.1-2020 workplace violence case workflow
- Single-tenant deployment for data-residency requirements
- Audit-ready incident export for board, regulator, and civil-discovery scrutiny
Integrations
30+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, ServiceNow, Salesforce, Custom REST API.
Target size
50 to 25,000 employees · US · Canada · EU · UK · AU