UpGuard
Third-party cyber risk management: continuous monitoring, ratings, and questionnaire automation.
About
UpGuard unifies third-party cyber risk management into one platform: continuous outside-in monitoring of vendors' attack surfaces, security ratings, and questionnaire automation. Its engine scans a claimed 1 billion-plus risk signals daily across 15 million organizations against hundreds of risk signals, surfacing exposures, misconfigurations, CVEs, and security incidents the moment they appear, with on-demand rescans instead of point-in-time snapshots. Vendor Tiering and Trust Page features help teams prioritize critical vendors and centralize security documentation.
For the assessment side, AI Autofill and assessment automation cut the manual effort behind security questionnaires, with a library mapping to frameworks like NIST 800-53 and GDPR. UpGuard publishes its pricing openly (Vendor Risk Standard at $1,750 per month billed annually for 50 vendors), and its own materials cite a G2 ranking of number one in third-party and supplier risk management. Daily-scan and scale figures are vendor-reported.
What it can do
- Continuous third-party attack surface monitoring
- Security ratings and risk scoring
- AI Autofill questionnaire automation
- Vendor Tiering and risk prioritization
- Data leak and dark web detection
- Compliance mapping: NIST 800-53, GDPR, and more
- Trust Page for vendor security documentation
- Transparent published pricing
Setup
- Start a free trial at upguard.com; no sales call required to evaluate published plans.
- Add your vendors and let continuous monitoring scan their attack surfaces.
- Send automated questionnaires with AI Autofill; map responses to NIST, GDPR, and other frameworks.
- Set custom alert thresholds and push findings into remediation workflows.
Prerequisites
A vendor inventory to monitor; questionnaire templates if customizing assessments beyond the built-in library.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (TIER verified, metrics-v1). Evidence: long operating history in TPRM; vendor-reported scale of 1B+ daily risk signals across 15M organizations; transparent published pricing (rare in this category); cited G2 leadership in TPRM; documentation covers OCC, FFIEC, and NIST compliance workflows. Strengths: monitoring plus questionnaires in one platform, daily scans rather than snapshots, pricing transparency. Docked for: (1) scale figures are vendor-reported and not independently auditable; (2) ratings-first outside-in scoring can overstate or understate real-world risk, a skepticism the company itself acknowledges. License: proprietary.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 4.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · Monitoring plus questionnaire automation in one TPRM platform
- · Transparent published pricing; 1B+ daily risk signals per vendor
- · Compliance workflow coverage: OCC, FFIEC, NIST 800-53
- · Scale figures vendor-reported; outside-in ratings can misjudge real risk
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.