UpGuard Vendor Risk Reviews & Product Details

What I like most about UpGuard Vendor Risk is its centralized visibility into the third party security posture. It helps us monitor vendor risks, identify security weaknesses, monitor changes in vendor security ratings, and prioritize potential risks. The UI is smooth and easy to understand, this overall improves time efficiency. The integration is very easy. The performance is quite good because as we add any domain or ip address, it instantly identifies the risks associated with it. The UpGuard product support is well trained that ultimately helps resolve any issue we face regarding the product. Review collected by and hosted on G2.com.

The recurring issue we are facing is with some subdomains are not properly scanned, due to which the score in negatively impacted. Once we manually scan those subdomains the false positive risk disappears and the true risk score is reflected.

There is one more issue, although we have whitelisted the UpGuard scanner ip address ranges over our cloudflare. So that, cloudflare won't block them according to the bot rule enforced. But still some false positive security header risks are shows which actually exist over the domain/subdomain. Review collected by and hosted on G2.com.

This tool makes tracking vendor risk much easier without ever feeling overwhelming. The interface is clean and straightforward, the automated questionnaire features save our team hours of back-and-forth, and the security scores provide a quick snapshot of where each vendor stands. On top of that, their support team is genuinely helpful and responds quickly whenever we need them. Review collected by and hosted on G2.com.

Occasionally, some automated findings still need manual verification before we pass them along to vendors, since the surrounding context or any compensating controls aren’t always captured right away. In addition, I’d like a bit more flexibility in report customization, especially when presenting summary data to non-technical stakeholders. Review collected by and hosted on G2.com.

The best parts are the AI review of the content I add and the support I get with the tool. If I ever have issues or questions, the support team usually jumps on them quickly, and if I run into a problem with a specific feature, it gets reviewed and addressed fast. Overall, it performs very well. I can submit a significant number of documents for the AI to review, and it finishes in a reasonable amount of time.

I’d rate the interface a six out of ten. It’s good overall, but there are still areas that could be cleaned up or improved, and a few things that could be added. Pricing was cheaper than other competitors I’ve used in the past, which is a bonus for a medium-sized organization. That said, I’m not aware of any integrations, so if you’re looking to connect it with systems you already have (like a contract system), you may need to approach it differently. Review collected by and hosted on G2.com.

I wish it offered a portal for vendors to log in and fill out forms, rather than only having a portal for internal users. I also wish there were a way to combine vendors that are under the same company into one larger group, so it’s easier to keep up with them. Finally, I’d like it to automatically pull contracts in from the contract system so the process isn’t manual. Review collected by and hosted on G2.com.

It helps me assess third-party security risks without relying entirely on lengthy questionnaires and manual research. The external security ratings and continuous monitoring make it easier to identify vendors with potential vulnerabilities, track changes in their security posture, and prioritize which suppliers need further review. I also like having vendor risk information organized in one place, which makes it simpler to stay on top of everything. Review collected by and hosted on G2.com.

Security ratings are useful for initial screening, but they may not always reflect a vendor’s complete internal security controls or operational risks. I’d like more flexibility to customize risk scoring criteria based on our company specific policies and criticality. It would also be helpful to have more streamlined workflows for collecting evidence from vendors, assigning remediation owners, and tracking corrective actions. Review collected by and hosted on G2.com.

The visibility it gives us over our suppliers’ cyber security is probably the biggest benefit. Having specific findings to follow up gives us a useful starting point for conversations with suppliers and helps us understand where we need to ask more questions.

I also like the questionnaire features, particularly the option for suppliers to upload existing policies and certifications and use AI to help populate their responses. We’re still exploring that side of it, but I can see the value in reducing repetitive form filling and making assessments less of a chore for suppliers. Review collected by and hosted on G2.com.

Some of the technical findings can take a bit of explaining, particularly when sharing reports with suppliers who don’t have an IT background. We’ve had questions about what has actually been detected and how it relates to their systems. Clearer plain-English explanations of the issue, why it matters, and what the supplier needs to check would make those conversations easier. Review collected by and hosted on G2.com.

I like the ability to look across all of my vendors to see where threat surface issues arise is helpful, since TPRM is only one aspect of our cyber risk management program. The regular updates (essentially daily) are helpful. We have not connected it to other tools, but the exports of risk reports are important for our risk register. Review collected by and hosted on G2.com.

As with any utility, getting vendors to complete their end of the workflow is a challenge. I also find it an annoyance that other features in the portal point to "learn more" as an a-la-carte licensing model, vs. all the features come in my licensing. Review collected by and hosted on G2.com.

What I like best about UpGuard Vendor Risk is having a clear overview of vendor security information in one place. The interface is easy to navigate, and the way findings are presented helps me understand which issues need closer attention. From a cybersecurity and risk management perspective, this is a useful starting point for prioritizing further assessments and discussing security concerns with colleagues. Review collected by and hosted on G2.com.

One area that could be improved is the amount of information presented at once. Some sections can feel a bit dense at first, especially when reviewing multiple vendors or findings. A more customizable view, with additional filtering and prioritization options, could make the analysis even faster and more efficient. Review collected by and hosted on G2.com.

UpGuard provides clear visibility into our organization’s security posture with easy-to-understand risk ratings. The platform makes it simple to monitor domain reputation, identify vulnerabilities quickly, and ensure continuous threat protection. Review collected by and hosted on G2.com.

Some advanced features require fine-tuning, and the reporting could be more customizable. It would also be helpful if the platform could generate comprehensive PDF reports for easy sharing with the management team. Overall, the platform is very effective. Review collected by and hosted on G2.com.

What I like best is how much time UpGuard saves on vendor assessments. The automated security questionnaires replaced our old spreadsheet-and-email process, and the built-in templates (like SIG Lite and ISO 27001) mean we don’t have to build questionnaires from scratch. Continuous monitoring is another big plus: instead of point-in-time reviews, we get alerts when a vendor’s security rating drops, so we can follow up right away. The dashboard is clean and easy to navigate, and the remediation workflow makes it simple to request fixes from vendors and track their progress in one place. It’s also made reporting to leadership much easier since we can show risk trends at a glance. Review collected by and hosted on G2.com.

My main downside is pricing. It’s on the higher end, which can be hard to justify for smaller teams or organizations with only a handful of critical vendors, and more flexible tiers would help. The security ratings, which come from external scans, sometimes flag issues that turn out to be false positives or outdated findings, so we occasionally spend time validating results before acting on them. Some pages can also be a bit slow to load when working with a large vendor list. Finally, I’d like more native integrations with tools like ticketing and GRC platforms, plus more customization in reports, so we could fit UpGuard into our existing workflows without manual exports. Review collected by and hosted on G2.com.

UpGuard gives us a single, clear view of our third-party risk. Its security rating and continuous monitoring help us quickly spot changes in a vendor’s security posture, without having to chase them down manually. Review collected by and hosted on G2.com.

Some security findings can occasionally be outdated or tied to the wrong domains, so we sometimes need to double-check the results with vendors before taking action. Overall, these are relatively minor concerns compared to the value we get, and the support team has been responsive whenever we’ve brought them up. Review collected by and hosted on G2.com.