ZeroRisk raises $10 million to scale merchant cybersecurity platform

ZeroRisk raised $10 million in a Series A led by MiddleGame Ventures to fund global expansion, product development and deployments across major payment providers. The merchant cybersecurity platform, which counts Bank of America, Global Payments, Checkout.com and Trust Payments among customers, expects 2026 revenue to triple as contracted programs enter deployment. The funding supports ZeroRisk's push to scale risk monitoring, compliance and remediation services for payment providers' merchant portfolios.

Analysis

The strategic read-through for BAC and GPN is modestly favorable but not earnings-material near term: merchant-level cyber tooling can reduce fraud-loss volatility, PCI/compliance servicing costs, and merchant churn while creating an attachable services revenue stream. The more meaningful implication is competitive: acquirers that operationalize portfolio-wide remediation can price cyber protection into SME bundles, raising switching costs and partially offsetting structural pressure on payment take rates.

ZeroRisk’s claimed customer traction is not independently sufficient to infer revenue contribution, and a $10m financing round is too small to alter listed-company capex or vendor economics. The principal 1-3 month catalyst is evidence in GPN’s merchant-solutions disclosures of higher value-added-services penetration or reduced fraud/chargeback expense; absent quantified adoption, this is a vendor-validation datapoint rather than a reason to revise estimates. Over 6-18 months, scaled risk orchestration could disadvantage standalone PCI-compliance vendors and low-service merchant acquirers, while benefiting platforms with large SME distribution and cross-sell capacity.

Consensus may underappreciate that cybersecurity is increasingly a retention product rather than merely a loss-control cost. For GPN, whose valuation depends on restoring organic growth and margins, incremental recurring merchant services revenue has a higher strategic value than its initial dollar contribution. Conversely, processor clients can multi-source risk tools or build internally, limiting vendor pricing power and making any purported ecosystem lock-in fragile.

Key Decisions for Investors

• No standalone trade on BAC: the likely financial exposure is immaterial versus BAC’s diversified earnings base. Monitor quarterly merchant-services commentary for quantified fraud-loss, chargeback, or cyber-service revenue effects before changing positioning.
• Maintain GPN as the cleaner public-market watch item; add only on evidence that value-added merchant-service attach rates are accelerating without renewed margin investment. A credible trigger is explicit guidance linking cyber/compliance bundles to organic revenue or adjusted operating-margin improvement over the next 1-3 quarters.
• Avoid extrapolating the private-company revenue-growth claim into GPN estimates until deployment volume, contract duration, and commercial model are disclosed. Thesis is falsified if GPN reports rising merchant-acquisition or technology expense without corresponding service-revenue growth, or if competitive pricing further compresses net revenue yield.
• For a payments-services relative view over 6-18 months, prefer GPN exposure over lower-value, transaction-only acquiring models, but use a defined-risk entry around earnings rather than chasing this announcement; the upside depends on demonstrated monetization, not vendor adoption alone.