UpGuard
Complete cyber risk posture management for vendors, attack surface, and workforce risk.
By UpGuard · HQ Mountain View, US · 4.5/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Security and TPRM teams that need continuous monitoring of third-party security ratings
- Organizations replacing manual security questionnaires with AI-assisted assessment and remediation workflows
- Companies that must evidence vendor oversight to regulators, boards, and enterprise customers
- Teams wanting one platform for vendor risk, attack surface, and human risk
- Businesses that also need to answer their own customers' security questionnaires faster
Ideal size: 3–50 security, risk, and compliance staff people · Mid-market to enterprise with a formal third-party risk program
Not for
- Teams looking for endpoint protection, SIEM, or network security tooling
- Very small businesses with only a handful of low-risk vendors
- Buyers seeking a free, fully featured TPRM program (free tier is questionnaire/trust-page focused)
- Organizations unwilling to invest in a formal vendor onboarding and tiering process
Value metrics scorecard
Time-to-Value
2–4 weeks (free trial, self-serve onboarding)
~30 days to first production value
Total Cost of Ownership
$21,000/yr
Starts at $21,000 · Tiered subscription billed annually; Standard $1,750/mo for 50 vendor slots; Professional, Corporate and Enterprise+ quoted on request.
Implementation Friction
3/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Standard: 6 admin/general users plus unlimited read-only; vendor slots scale 50 / 150 / 500 / unlimited by tier.
Add-on costs
- Additional vendor slots: $79/month each beyond the Standard allocation
Company & support
Who is behind UpGuard, and how your team gets help once it is live.
Company
- Founded
- 2012 · 14 yrs in business
- Headquarters
- Mountain View, US
How you get support
- PhoneNot listed
- EmailPlan not stated
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumNot listed
- Help centre / docsNot listed
- Dedicated account managerNot listed
- In person / on-siteNot listed
- Hours
- Not recorded
- Response time
- Not stated
Support email [email protected]. Enterprise+ plan lists Enterprise Support; no support hours or SLA are published.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where UpGuard sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- UpGuard
- VComply
- Dashlane
- Gatekeeper
- KnowBe4
- Mimecast
Add or change companies
Up to 10 companies including UpGuard. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
No supported MCP path today, so it cannot be driven from an AI client.
AI & MCP readiness
What UpGuard ships in AI, and what it asks of your ecosystem.
AI features shipped
Questionnaire AI in Trust Exchange drafts answers from the customer's existing questionnaires and security documentation, and vendor Security Profiles use AI document parsing for structured assessments. Model providers, AI logging scope, and model-training terms beyond Google Workspace and Microsoft Graph API data are not published.
Your data & models
- Trains on your data
- Never trains on your data
- Runs on
- Not recorded
- AI pricing
- Included in the plan
In your ecosystem
- AI connection
- Not supported
- Model key
- Not recorded
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
UpGuard is a cyber risk posture management platform that unifies vendor risk, attack surface, user risk, and trust exchange in one product. Security teams continuously monitor third-party security ratings, run AI-assisted questionnaire assessments and remediation workflows, and publish trust pages to speed up sales. Standard pricing is $1,750/month billed annually for 50 vendor slots, with higher tiers quoted. It reports 45,000+ customer companies, holds SOC 2 Type II attestation, and is a recurring G2 leader for third-party risk.
Frequently asked questions
What does UpGuard cost?
The published Standard plan is $1,750 per month billed annually (about $21,000 per year) and covers 50 monitored vendors, 6 admin/general users, and unlimited read-only users. Additional vendors cost $79 per month each. Professional, Corporate and Enterprise+ tiers, which add role-based accounts, fourth-party visibility, audit logs, and unlimited vendors/users, are quoted by sales. A free trial and a free Trust Exchange tier are available.
How long does it take to get value?
Because it is SaaS with a free trial and self-serve onboarding, most teams begin monitoring vendors within days to a few weeks. Published customer stories describe assessment cycles falling from about a month to a week, and around 2,000 hours of assessment effort saved per year for one customer.
Does UpGuard train its AI on our data?
UpGuard's privacy page states the company does not use Google Workspace API data or Microsoft Graph API data to develop, improve, or train generalized AI/ML models. Questionnaire AI is described as generating suggestions from your own questionnaire library and security documentation, which your team verifies. Broader model-training terms for all customer content are not published.
Which standards and frameworks does UpGuard support?
The site lists alignment and content for ISO 27001, NIST CSF, NIST 800, SIG Lite and SIG Core, APRA CPS 230, DPDP, DORA and UpGuard's own MFQ, with a questionnaire library and templates for building assessments against them. UpGuard itself is SOC 2 Type II attested and says its security program is maintained in alignment with ISO/IEC 27001.
Does it fit our existing stack?
Yes for common security and ITSM stacks. UpGuard offers a native Slack integration, Jira Cloud and ServiceNow integrations, notifications into Microsoft Teams, SSO via SAML/OIDC (Azure, Okta, Ping), an audit log on higher tiers, REST API access and webhooks for custom automation, and Zapier connectivity to thousands of other apps.
Who is UpGuard best suited for?
Mid-market to enterprise security, risk and compliance teams that manage a substantial vendor estate, especially in education, financial services, technology and healthcare. It suits organizations that need continuous monitoring plus defensible assessment evidence. It is not a substitute for endpoint, network, or clinical security tooling.