You supervise an entire sector. Today, you do it blind.
The Organic Law for the Strengthening of Cybersecurity (LOFC), in force since May 2026, placed the supervision of digital resilience in the hands of each sector's regulatory bodies. The responsibility is already yours. The tools, not yet.
On-site inspections that don't scale. Questionnaires that supervised entities fill out however they please. Sampling that leaves 90% of the universe unexamined. And the incident becomes known when it is already front-page news: when the harm to the citizen, the depositor or the policyholder has already been done.
If a technology provider shared by twenty of your supervised entities suffers an incident tomorrow, would your institution find out before the press, or after?
The LOFC is already in force.
And supervision is yours.
Since May 22, 2026, with the publication of the Organic Law for the Strengthening of Cybersecurity in the Official Registry, Ecuador has its first legal framework specific to cybersecurity. Three facts change the work of every regulatory body.
The authority to supervise and sanction rests with each sector's regulatory bodies
Not with some abstract entity: with yours. The law places responsibility for digital resilience on the sectoral regulator.
The law demands real monitoring, detection and response capabilities
Incident notification within 72 hours, plus drills and audits of critical infrastructure and essential services.
Secondary regulations are racing against the clock
Minimum standards and incident management regulations must be issued within the first months. When that happens, the sector will ask you how you verify compliance.
The standard you demand of your supervised entities is high. The uncomfortable question is what evidence you use to verify they meet it.
Today's supervision model
was designed for a different risk.
No regulatory body has enough inspectors to audit its entire supervised universe on site, every year. The result is a model with four structural blind spots.
Sampling
A fraction of the universe gets inspected; the rest operates unobserved for years.
Self-declaration
Questionnaires reflect what the supervised entity declares, not what its infrastructure exposes.
Reactivity
The regulator learns of the incident when the supervised entity reports it, or when the press publishes it.
Invisible systemic risk
Dozens of entities share the same technology providers. A single compromised provider can drag down half the sector, and today that map does not exist on any regulator's desk.
Supervision arrives late not for lack of rigor, but for lack of visibility. That is exactly the problem continuous rating solves.
Mastercard's RiskRecon: continuous rating of your entire supervised universe.
The same visibility you demand of your supervised entities, at the scale of the entire sector, measured continuously and without asking anyone for anything, so that supervision arrives before the incident does.
Mastercard's RiskRecon continuously monitors the exposed digital surface of every supervised entity and rates it from 0.0 to 10, with letter-grade equivalents from A to F, using open sources only: what each organization's infrastructure exposes to the internet, assessed the way an attacker would, but in the service of the supervisor.
No questionnaires, no agents, no access required
The assessment requires no permission, installation or cooperation from the evaluated entity. Supervised entities cannot dress up what their infrastructure publicly exposes.
Accuracy independently validated at 99.1%
With the lowest false-positive rate in the industry. Every finding is defensible before the supervised entity.
Real scale: more than 19 million organizations
The platform continuously monitors more than 19 million organizations worldwide. Covering the universe of a regulated Ecuadorian sector is not a pilot: it is its normal operation.
Prioritization by asset value
Not all findings carry the same weight: the platform weighs each system according to the data it handles and its exposure, and delivers action plans prioritized by risk.
RiskRecon identifies the technology providers shared across the entities in a portfolio, along with the ecosystem's single points of failure.
The fourth-party view that no individual questionnaire can build.
For the first time, the regulator can see the dependency map of its sector before a compromised provider draws it the hard way.
From supervising by sampling
to supervising the entire universe.
- Annual sampling of a fraction of the sector
- Self-declaration questionnaires
- The incident becomes known only after it has happened
- Risk assessed entity by entity, in silos
- Findings debatable on paper
- 100% of the supervised universe, monitored continuously
- Objective technical evidence from open sources
- Posture deterioration visible before the incident
- Systemic risk: shared providers and concentrations made visible
- Accuracy validated at 99.1%, defensible before the supervised entity
No platform replaces the supervisory authority, the formal processes or the judgment of the regulatory body. What Mastercard's RiskRecon delivers is the continuous technical visibility that supervision needs to act before the incident and to back its requirements with objective evidence.
From a supervised universe on paper
to the sector risk dashboard, in phases.
Universe definition
The list of supervised entities and their domains is loaded. No action is required from the entities.
Sector baseline
The first complete snapshot: a rating for each entity, the sector's risk distribution and the map of shared providers.
Continuous supervision
Permanent monitoring: deterioration alerts, new critical findings and the evolution of each rating over time.
Integration into the supervisory cycle
Ratings feed inspection planning, requirements issued to entities and institutional reporting. Avanti supports the operation alongside the backing of Mastercard.
Mastercard partners,
on the side of the regulator.
Avanti represents specialized manufacturers and delivers professional services, managed services and consulting in Ecuador, Colombia and Mexico. We have spent 15 years working with organizations in regulated sectors, and we are Mastercard partners for its cybersecurity portfolio in the region, which includes RiskRecon, Cyber Quant and cyber crisis exercises.
Our four specialization lines, anti-fraud, cybersecurity, customer experience and governance, allow us to understand digital risk from the perspective of both the regulator and the regulated, because we work with both.
A local team implements the platform with your institution, trains the supervision teams and supports the operation on an ongoing basis. The sale is the starting point, not the finish line: for a regulatory body, that commitment means technical continuity throughout the entire supervisory cycle, not a vendor that disappears after the signature.
It's time to act!
Let's schedule a demo session built on your sector's real universe: together, using open-source data, let's see what the cybersecurity posture of your supervised entities looks like today and which providers they share. No commitments, and without asking any of them for anything.
Return to the opening question: if a shared provider in your sector suffers an incident tonight, would you find out before the press, or after? With continuous supervision, the answer changes category: you would have seen it coming.
