HITRUST Partners with Brighton Park to Revolutionize Cybersecurity Landscape

Key facts

• Growth investment: HITRUST has received a growth investment of undisclosed size from Brighton Park Capital, announced March 17, 2025.
• Expansion plans: The money will fund expansion internationally, into new industries and into new products.
• No leadership change: Founder Daniel Nutkis remains CEO, and HITRUST’s mission and strategy are unchanged.
• Product focus: Continuous assurance, third-party risk management and AI risk assessments are among the areas getting more investment.

What HITRUST announced

HITRUST, the Frisco, Texas, organization behind the widely used HITRUST security certification, has taken a growth investment from Brighton Park Capital, a New York investment firm focused on growth-stage software and healthcare companies. The amount was not disclosed. HITRUST will continue to be led by Daniel Nutkis, who founded it in 2007.

Where the money goes

The investment will support HITRUST’s core assurance and certification programs and its expansion into new countries, industries and product areas. HITRUST is best known in health care, where many hospitals and insurers require vendors to hold its certification, and it wants to grow beyond that base.

New products

Part of the money will go to HITRUST’s newer offerings: continuous assurance through what it calls a cyber threat-adaptive engine, third-party risk management through its Assessment Xchange and a ServiceNow integration, and AI risk management and security assessments.

More vendors may face HITRUST demands

HITRUST certifications are already a common requirement in health care contracts. If the company succeeds in expanding into other industries and countries, more vendors could face HITRUST requirements from their customers. Its push into AI assessments also comes as companies look for a way to show that their AI systems are governed and secure.

What the executives said

“We are thrilled to welcome Brighton Park Capital as a strategic partner,” Nutkis said. “Their investment and industry expertise will be invaluable as we continue to innovate and expand our offerings to meet the evolving needs of our clients.”

Kevin Magan, a partner at Brighton Park, said: “We have deep conviction in the company’s mission and strategy. We look forward to partnering with Dan and his team to support the company’s next phase of growth, expanding its best-in-class frameworks and technologies into new verticals and geographies, while preserving the integrity and trust that makes HITRUST exceptional.”

Demand for proof of security

The deal reflects a broader trend. Customers, regulators and insurers want proof that suppliers have real security controls in place, and certifications are one way to provide it. HITRUST says its framework draws on more than 50 standards and is assessed by an ecosystem of over 100 independent assessment firms.

Brighton Park’s investment gives HITRUST money to compete as more frameworks, including ones focused on AI, enter the assurance market.

What to watch

The key question is whether HITRUST can repeat its health care success in other industries. Watch for new certification options outside health care and for uptake of its AI assessments.

For organizations that already hold HITRUST certification, the company says nothing changes in the short term.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.