Capital

16,000 Firms Pooled Their Supplier Risk. You Didn't

Risk Ledger raised 24 million pounds in Series B on 15 July 2026 for a network-first supplier-risk platform used by 16,000 organisations. Why NIS2 and DORA make the questionnaire model your problem, and what European owners should change.

CapitalBy Servola Tech Desk2026-07-184 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

16,000 Firms Pooled Their Supplier Risk. You Didn't

Key takeaways

Risk Ledger raised 24 million pounds in Series B on 15 July 2026, and under NIS2 and DORA the supplier weaknesses it maps are now your legal liability, not your supplier's private problem.
The round targets a specific habit: assessing each supplier once, by questionnaire, at a single point in time. Risk Ledger's pitch is that this model cannot see how modern supply chains actually fail.
More than 16,000 organisations already sit on its shared network, so one supplier's answers are visible to every buyer that relies on it, instead of being re-collected in thousands of separate spreadsheets.
Axiom Equity led the raise and its founding partner called Risk Ledger a company creating a category rather than competing in an old one, a claim the regulation now backs.
If your third-party risk process is still an annual questionnaire, the law moved past it: check whether you can prove a supplier's security continuously, not once a year.

The round, and what it signals

The money went to a model, not a product feature. Risk Ledger, a London company, confirmed on 15 July 2026 that it had raised 24 million pounds in a Series B round led by Axiom Equity, with Mercia Ventures returning from the Series A. The raise takes the company's total funding to roughly 34 million pounds and will pay for a deeper UK network, AI-assisted assessment tools, and a push into the United States.

Jonathan Organ, founding partner at Axiom Equity, said the company is creating a category rather than competing in an old one. That is investor language, but it points at something real: the thing Risk Ledger sells is not a better questionnaire. It is the argument that the questionnaire itself is the wrong shape for the problem, and that a shared network is the right one.

Why the questionnaire model is the target

Most supplier risk today is a point-in-time snapshot. A buyer sends a supplier a security questionnaire, files the answers, and moves on. The next review might be a year away. Risk Ledger's chief executive, Haydn Brooks, frames the alternative as organisations that defend as one, sharing intelligence and reducing risk together rather than each re-interviewing the same suppliers in isolation.

The weakness of the old model is not effort, it is timing and duplication. A supplier that was secure when it answered your form can be breached the next week, and you would not know until your next scheduled review. Meanwhile ten of your peers are sending that same supplier the same questions, and none of the answers are shared. A network assesses the supplier once and shows the result to everyone who depends on it.

The law turned supplier risk into your liability

This raise lands on top of a legal shift, not a marketing trend. Under the EU's NIS2 directive and, for financial firms, the DORA regulation, a security failure inside your supply chain is now your accountability to manage and evidence, not a private matter for the supplier. Boards can be held responsible for third-party risk they cannot show they controlled.

That is the quiet reason a supply-chain risk platform can raise at this scale. Regulators converted supplier due diligence from a procurement courtesy into a documented obligation with named owners. The market has now priced that obligation, and it decided the annual spreadsheet is not what satisfies it.

What a shared network changes

The network's value is that it removes the re-collection tax. With more than 16,000 organisations on the platform, spanning financial services, insurance, critical national infrastructure and government, a supplier records its security posture once and every connected buyer sees it. The buyer's job shifts from chasing forms to reading a live picture.

There is a trade to name honestly. A shared network concentrates a lot of sensitive supplier data in one place, and it is only as current as the suppliers keep it. But against a status quo of stale, siloed questionnaires, a continuously updated shared view is a genuinely different instrument, which is what the category claim rests on.

Where this leaves you

The action is not to buy this specific product, it is to check your model. Ask whether your organisation can show, today, that a critical supplier is secure, or whether the most recent evidence is a questionnaire someone filed months ago. Under NIS2 and DORA, that gap is now a compliance exposure, not just an operational one.

Funding rounds are usually noise for an owner. This one is a signal, because the investors are betting on a regulatory reality you already live under. The question the raise puts to you is simple: is your third-party risk process built for the law as it is now, or the law as it was five years ago?

Frequently asked questions

What is Risk Ledger's network-first model?

Instead of every buyer sending each supplier its own security questionnaire, a supplier documents its security posture once on a shared network, and every connected buyer can see it. Risk Ledger says more than 16,000 organisations already participate, which turns one-off assessments into a continuously visible picture.

Do NIS2 and DORA really make me responsible for a supplier's breach?

They make you responsible for managing and evidencing third-party risk. Under NIS2, essential and important entities must control supply-chain security and can face management liability; under DORA, financial firms must oversee their ICT third parties. A supplier breach you cannot show you managed becomes your regulatory problem.

Is a 24 million pound round large for this niche?

It is meaningful for a supply-chain risk specialist, and it takes the company past 30 million pounds raised in total. The size matters less than the reason: investors are pricing a regulated obligation that owners must meet, which is why the lead investor framed it as building a new category.

The questionnaire you send once a year was built for a time when a supplier's security was the supplier's problem. That time ended when the law made it yours.

Risk LedgerSupply chain securityNIS2DORASeries BCybersecurityUnited KingdomThird-party risk

Progress tells ShareFile users to pull the plug

Progress Software told ShareFile customers to physically shut down on-prem Storage Zone Controllers over a credible threat. No patch, no CVE. What owners should learn.

3 min read

AI Policy

Europe Will Grade Frontier AI Itself Now

On 7 July 2026 the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. It adds no new law and leans on NIS2, the Cyber Resilience Act and the AI Act, while building an EU capacity to test frontier models instead of trusting vendor claims. From 2 August the Commission can enforce against general-purpose AI.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles