Why is there a discrepancy in number of detected vulnerabilities in Risk Analyzer?

The NVD (National Vulnerability Database) continually updates vulnerability definitions. 

The main vulnerability feeds provide CVE® data organized by the first four digits of a CVE® identifier except for the 2002 feeds which include vulnerabilities prior to and including CVE-2002-.

Each feed is updated only if the content of that feed has changed. For example the 2004 feeds will be updated only if there is an addition or modification to any vulnerability with a starting CVE® identifier of CVE-2004-. In addition, the "recent" feeds are a list of recently published vulnerabilities and the "modified" feeds are a list of recently published and modified vulnerabilities where "recently" and "modified" are defined as the previous eight days. These feeds are updated approximately every two hours.

These feeds are updated every 2 hours. Depending on when updates are happening, the numbers could be different from what is displayed in FireMon's Risk Analyzer.