Managed Supply Chain and Third-Party Information Risk Assessment

C2 Cyber is a London risk management company founded in 2015 by Jonathan Wood, starting as a consultancy delivering services to the UK intelligence community before building a product around the same work. It launched COBRA in 2019 and rebranded as C2 Risk in 2023 to reflect a scope that had grown beyond cyber into privacy and ESG. Its buyers are organizations that must account for the risk their suppliers and vendors carry into the business.

COBRA is delivered as a managed service rather than a self-service questionnaire tool. It gathers open source intelligence on a supplier, engages that supplier directly for evidence, runs analytics over the results, and puts security analysts on the interpretation, producing a risk position and specific actions. Clients then work with suppliers to close the gaps over time, so an assessment functions as an ongoing relationship rather than a one-off score filed after procurement.

The wider C2 Risk platform, RiskStore, extends the same model to internal assessments, compliance, project risk, privacy, and ESG, so supplier work and first-party risk sit in one system. Managed services let a client hand the whole risk lifecycle to C2 analysts instead of hiring for it, which is the main draw for teams without a dedicated third-party risk function. The company is listed on the UK government's G-Cloud Digital Marketplace and has won a National Cyber Award.