UpGuard Vendor Risk Reviews & Product Details

This tool makes tracking vendor risk much easier without ever feeling overwhelming. The interface is clean and straightforward, the automated questionnaire features save our team hours of back-and-forth, and the security scores provide a quick snapshot of where each vendor stands. On top of that, their support team is genuinely helpful and responds quickly whenever we need them. Review collected by and hosted on G2.com.

Occasionally, some automated findings still need manual verification before we pass them along to vendors, since the surrounding context or any compensating controls aren’t always captured right away. In addition, I’d like a bit more flexibility in report customization, especially when presenting summary data to non-technical stakeholders. Review collected by and hosted on G2.com.

The best parts are the AI review of the content I add and the support I get with the tool. If I ever have issues or questions, the support team usually jumps on them quickly, and if I run into a problem with a specific feature, it gets reviewed and addressed fast. Overall, it performs very well. I can submit a significant number of documents for the AI to review, and it finishes in a reasonable amount of time.

I’d rate the interface a six out of ten. It’s good overall, but there are still areas that could be cleaned up or improved, and a few things that could be added. Pricing was cheaper than other competitors I’ve used in the past, which is a bonus for a medium-sized organization. That said, I’m not aware of any integrations, so if you’re looking to connect it with systems you already have (like a contract system), you may need to approach it differently. Review collected by and hosted on G2.com.

I wish it offered a portal for vendors to log in and fill out forms, rather than only having a portal for internal users. I also wish there were a way to combine vendors that are under the same company into one larger group, so it’s easier to keep up with them. Finally, I’d like it to automatically pull contracts in from the contract system so the process isn’t manual. Review collected by and hosted on G2.com.

I like the ability to look across all of my vendors to see where threat surface issues arise is helpful, since TPRM is only one aspect of our cyber risk management program. The regular updates (essentially daily) are helpful. We have not connected it to other tools, but the exports of risk reports are important for our risk register. Review collected by and hosted on G2.com.

As with any utility, getting vendors to complete their end of the workflow is a challenge. I also find it an annoyance that other features in the portal point to "learn more" as an a-la-carte licensing model, vs. all the features come in my licensing. Review collected by and hosted on G2.com.

What I like best is how much time UpGuard saves on vendor assessments. The automated security questionnaires replaced our old spreadsheet-and-email process, and the built-in templates (like SIG Lite and ISO 27001) mean we don’t have to build questionnaires from scratch. Continuous monitoring is another big plus: instead of point-in-time reviews, we get alerts when a vendor’s security rating drops, so we can follow up right away. The dashboard is clean and easy to navigate, and the remediation workflow makes it simple to request fixes from vendors and track their progress in one place. It’s also made reporting to leadership much easier since we can show risk trends at a glance. Review collected by and hosted on G2.com.

My main downside is pricing. It’s on the higher end, which can be hard to justify for smaller teams or organizations with only a handful of critical vendors, and more flexible tiers would help. The security ratings, which come from external scans, sometimes flag issues that turn out to be false positives or outdated findings, so we occasionally spend time validating results before acting on them. Some pages can also be a bit slow to load when working with a large vendor list. Finally, I’d like more native integrations with tools like ticketing and GRC platforms, plus more customization in reports, so we could fit UpGuard into our existing workflows without manual exports. Review collected by and hosted on G2.com.

I use Vendor Risk to get a bird's eye view of cyber risk associated with vendors, both prior to onboarding and for ongoing assessments. I'm able to view and compare numerous clients simultaneously and create groupings to compare similar services accurately. I like that the interface is intuitive and easy to navigate, which makes it user-friendly. Setting up was easy, and the reps provided a smooth experience, answering any questions we might have. Review collected by and hosted on G2.com.

The provided information regarding risk is very generic and surface level. It would be nice if the information was a little more robust. Review collected by and hosted on G2.com.

My favourite thing about it is that you can set up automated alerts and notifications for critical third-party security incidents, which allows us to quickly contact any affected employees. Review collected by and hosted on G2.com.

So far I don’t have any major dislikes. The only issue I’ve noticed is a slight delay in third-party breach alert notifications compared to HIBP. Review collected by and hosted on G2.com.

Upguard has been very instrumental in building our TPRM program from scratch. The UI is simple and intuitive, the alert reporting from the platform is pretty flexible and ranges from email to Slack to MS Teams. Gives a very good insight into the vendor security posture as well as your own security posture to keep reinforcing the best security practices to secure the perimeter. The subscription is appropriately priced too for the capability that it offers. The threat intelligence feed coming from it is timely and usable and helps keeping vendor risks in check. We have had a good support all through during the onboarding. Review collected by and hosted on G2.com.

I wouldn't say dislike, but they can fortify it further tor nthPRM as that's a chain that can help manage the risk better. Review collected by and hosted on G2.com.

UpGuard Vendor Risk has made third-party security assessments much more efficient by bringing questionnaires, evidence collection, and vendor communications into a single platform. I particularly like the ability to assign questions to different stakeholders and track completion status without relying on long email threads. The platform also provides good visibility into vendor risk posture and simplifies the review process during security due diligence. Review collected by and hosted on G2.com.

The platform is easy to use overall, but navigating between different questionnaire sections can sometimes be confusing, especially when certain sections depend on others being completed first. Clearer workflow guidance and section dependencies would improve the user experience. Review collected by and hosted on G2.com.

I would be very likely to recommend UpGuard Vendor Risk to other security, GRC, and procurement teams looking to mature their third-party risk management process. The platform provides a good balance of vendor onboarding, assessment workflows, risk visibility, and continuous monitoring in one place. It has helped us move away from a highly manual process and establish a more structured and trackable VRM workflow. While there are still areas where deeper customization would be helpful, the overall platform is valuable and practical for managing vendor risk at scale. Review collected by and hosted on G2.com.

UpGuard Vendor Risk is useful overall, but some areas could be improved to better support mature VRM workflows. The questionnaire scoring model can feel rigid, especially when a few high or critical gaps significantly reduce the overall score even if most controls are satisfactory. More flexibility to customize scoring weightage, severity contribution, and assessment outcomes would help organizations align the platform with their internal risk methodology. Some workflow customization options could also be expanded, especially around onboarding forms, approvals, reporting views, and automation logic. Review collected by and hosted on G2.com.

What I like best about UpGuard Vendor Risk is having a clear overview of vendor security information in one place. The interface is easy to navigate, and the way findings are presented helps me understand which issues need closer attention. From a cybersecurity and risk management perspective, this is a useful starting point for prioritizing further assessments and discussing security concerns with colleagues. Review collected by and hosted on G2.com.

One area that could be improved is the amount of information presented at once. Some sections can feel a bit dense at first, especially when reviewing multiple vendors or findings. A more customizable view, with additional filtering and prioritization options, could make the analysis even faster and more efficient. Review collected by and hosted on G2.com.