ZeroRisk's $10M: your processor now scores your security

ZeroRisk, an Irish security and compliance company founded in 2023, raised a $10 million Series A led by MiddleGame Ventures on September 9. The product gives banks and payment providers a single view of cyber risk across their entire merchant base. Read that from the other side of the table: if you accept card payments, your processor is buying a tool whose job is to grade you continuously.

What actually happened

Per the company announcement, MiddleGame Ventures led with existing investor Elkstone participating. RTÉ reports the company works with Bank of America, Global Payments, Checkout.com, and Trust Payments, operates from Dublin, Atlanta, and Longford, and expects revenue to roughly triple in 2026 as signed contracts move into deployment. The money goes to global expansion and to the operational capacity needed to roll the platform across large merchant portfolios.

The platform bundles risk monitoring, compliance, education, guided remediation, and protection services in one place. For the payment provider, the pitch is portfolio-wide visibility plus turning a compliance obligation into a billable merchant service. CEO Gary Nolan named the shift: managing merchant risk through annual compliance exercises is no longer enough.

That last sentence is the whole story. Annual becomes continuous.

Why it matters for your business

The self-assessment questionnaire you fill out once a year has always been a fiction, and everyone involved knew it. You answered honestly in March and shipped four plugin updates in April. Continuous monitoring closes that gap, and the gap is where most small merchants actually live.

What changes for an operator taking cards:

Your externally visible posture becomes a commercial input. Expired certificates, exposed admin panels, unpatched storefront versions, leaked credentials in public repos — these get scanned and scored whether or not you consent, because the scan runs from outside. Your processor's risk team sees the result before you do. In a portfolio product, a bad score doesn't produce a friendly email. It produces a reserve requirement, a rate adjustment, or a remediation deadline.

Compliance becomes an upsell channel. "Turning compliance obligations into revenue-generating merchant service opportunities" is a direct quote from the pitch. Expect security services offered to you by the company that also processes your money and holds the leverage. Some of those offers will be good. Price them against an independent alternative anyway — a vendor that both grades you and sells you the fix is not a neutral party.

Do the scan yourself first. Everything a portfolio scanner sees, you can see. Certificate expiry, open ports, admin endpoints reachable from the public internet, your storefront and plugin versions against current CVEs, credentials in your public repos. Run it monthly. Being ahead of your processor's finding is a materially different conversation than answering one.

The direction of travel is clear enough. Merchant security is moving from a form you sign to a number someone else calculates about you. You do not get a vote on that. You do get to know your own number first.

Sources: ZeroRisk announcement, RTÉ.