The earliest mention of Risan (Rizon) dates back to the 4th century BC. Risan (Rhizon) had been the main fortress in the Illyrian state where the queen Teuta took refuge. In Roman times, Risan is documented under the name Rhizinium as an oppidum civium Romanorum. The invasions of the Avars and Slavs left Risan deserted. The last reference of a bishop in Risan dates back to AD 595. The emperor Constantine Porphyrogenitus includes Risan among the inhabited towns of Travunia, while the priest of Doclea considers Rissena to be a district.

In the Middle Ages Risan lost the significance it used to have in the ancient times, when the whole Gulf of Kotor had been called Sinnus Rhisonicus (the Gulf of Risan ) and two Roman routes had led through it. In the mid 15th century, Risan was referred to as the town of Herceg (duke) Stjepan. In 1466, the Venetians offered to give Brac Island and a palace in Split to Herceg Stjepan, in exchange for his two towns (Risan and Novi) in the Boka Kotorska. The Turks took Risan, together with Herceg Novi, from Herceg Stjepan's son Vlatko in 1482.

In the present-day Risan there are no elements that could connect it to the medieval town. Risan by the sea was probably just a settlement. However, on the Gradina hill, above the famous archeological site of Carine, a fortification is situated containing remains of an Illyrian-Greek acropolis as well as the medieval and Turkish stratum. The position of the fortification was excellent, particularly for the control of Risan – Onogošt route, while the hilltop itself was inaccessible.