UpGuard

• UpGuard is the source for its own scale: the 50k-organization reach, the count of over 2,000 customers and the daily risk-signal figure all come from company announcements, no independent source in the reviewed record states any of them, and the vendor's own signal figure reads more than 100 billion a day in February 2026 and more than 1 billion a day in August 2026.
• UpGuard reports reach as organizations and customers as a subset of them, and its Trust Exchange product needs no credit card and no sales call, so the reach figure can grow without the paid base growing with it.
• G2's pros-and-cons summary of those 735 reviews lists Expensive among the recurring criticisms, so price resistance shows up in the same independent record that carries the 4.5 rating.
• UpGuard's own comparison page says the product does not translate risk into dollar figures, so a buyer whose program requires financial risk quantification has to cover that outside the platform.
• The Series C is earmarked in part for acquisitions, and an acquisition would change the product surface a buyer evaluates today.

UpGuard sells to the security function that has to answer for suppliers it does not control. Its vendor product runs onboarding, assessment, remediation and continuous monitoring in one place, and its compliance pages attach that work to named obligations. The APRA page states that the Prudential Standard CPS 230 takes effect from July 1st, 2025, and pages for DORA, NIST and the SIG questionnaires sit beside it.

The problem has widened rather than moved. User Risk addresses staff signing up for AI tools the security team never reviewed, and Breach Risk addresses the organization's own internet-facing exposure, so a buyer who arrived for third-party risk is offered two more problems from the same console.

The compliance surface is where a buyer's obligation set shows up. UpGuard publishes questionnaire and guidance pages for ISO 27001, NIST, SIG Lite, SIG Core, APRA CPS 230, DORA, DPDP and its own multi-framework questionnaire, which is the paperwork a regulated buyer arrives holding. [s17, s1, s3, s5, s4, s14]

The same scanning feeds two of the products a buyer evaluates separately. UpGuard describes proprietary scanning infrastructure that collects billions of data points daily through commercial, open-source and proprietary methods, with a stated focus on non-invasive passive collection, and the same collection feeds both the vendor ratings and the customer's own attack surface view.

The scoring model is documented in specifics. Checks feed a rating out of 950 for each internet-facing property, the algorithm subtracts points by severity and weight, an organization's overall score is a Gaussian weighted average that gives the worst asset the most weight, and the checks inside each of ten risk categories carry fixed weights. Vendor Risk states that ratings update multiple times per day.

AI appears as named tasks rather than as the product. UpGuard says its threat analyst triages breach signals, document analysis reads vendor evidence, and Questionnaire AI drafts answers from a customer's own library, and it publishes usage measurements for all of it, including 23 billion tokens processed in 100 days and 700k autofilled questionnaires to date. [s7, s3, s4, s13, s6]

Both sides of the ratings rivalry name each other in print. UpGuard publishes comparison pages against Bitsight, SecurityScorecard, CyberGRX and RiskRecon, and SecurityScorecard publishes a page on why customers choose it over UpGuard, which is as close to mutual acknowledgement as vendor material gets. G2 independently lists SecurityScorecard and Bitsight as the products buyers compare UpGuard Vendor Risk against. Forrester's 2024 evaluation of the same market ranked UpGuard a Contender, a tier below the Strong Performers and outside the leaders, and Forrester published a further edition of that evaluation in April 2026.

UpGuard's own argument on that page is about access. It says paid vendor risk plans start at USD 1,750 per month billed annually and that a free tier monitors up to five vendors, and it frames the product as fitting mid-market teams that deploy quickly.

The same page concedes a gap, which is unusual enough to note. UpGuard writes there that the product does not translate risk into dollar figures, so a buyer who needs financial risk quantification has to cover it outside the platform. [s14, s23, s24, s25, s26, s1, s8]

The funnel starts at zero cost. Trust Exchange is free to anyone, with UpGuard stating there is no credit card and no sales call to get started, and the Bitsight comparison page adds a free tier that monitors up to five vendors. Paid Vendor Risk plans open at $1,750 a month billed annually for 50 vendors, with extra vendors at $79 a month.

Named references are the strongest part of the traction record. UpGuard publishes case studies for Morningstar, Colorado State University, St John WA and Intercontinental Exchange, quotes a New York Stock Exchange technology executive by name on the Vendor Risk page, and lists TDK, PagerDuty, Hopin and IAG among customers on its Bitsight comparison page.

UpGuard announced on August 12, 2026 that the platform is available on Google Cloud Marketplace, where a Google Cloud marketplace director is quoted in the release, and says buyers can draw on committed Google Cloud spend to pay for it.

UpGuard supplies its own scale figures. Its February 2026 announcement counts 50k organizations in more than 90 countries and over 2000 customers, and the same paragraph claims a G2 category standing across 15 consecutive quarters. Startup Daily reported the US$75 million round, and the customer figures inside that article are quoted from the chief executive.

The independent volume is on G2. That site hosts 735 reviews of Vendor Risk at 4.5 out of 5 and counts 282 of the reviews at companies of 51 to 1,000 employees. The review records it displays carry incentivized, seller-invited labels. [s6, s14, s8, s11, s3, s13, s18, s24]

The company is older than its current name. Startup Daily reports that UpGuard was founded in 2012 as ScriptRock by Mike Baukes and Alan Sharp-Paul, and the SEC filing index records the same entity under the former name ScriptRock Inc. through August 2014.

Leadership is published as a roster rather than as biographies. The about page names Mike Baukes as co-founder and chief executive alongside a chief product officer, chief operating officer, chief financial officer, chief information security officer, chief marketing officer, chief revenue officer and chief of staff, without prior roles for any of them, so the team's public track record is the research the company publishes rather than the executives' histories.

The durable public signal is the research. UpGuard's breach research index carries dated posts with a named author through 2025 and 2026, its published research guidelines describe a disclosure process reviewed quarterly with outside counsel, CyberScoop credited an UpGuard analyst with the 198-million-voter exposure in 2017, and SecurityBrief covered its streaming and betting research in June 2026. [s18, s21, s9, s16, s15, s19, s20]

What UpGuard documents about itself is enterprise assurance plus one state certification. Its security page states the company is SOC 2 Type II compliant with annual attestation, that the security program is maintained in alignment with ISO/IEC 27001, and that a third party runs application penetration testing annually, and a separate August 2023 announcement records TX-RAMP certification under the Texas program for cloud services sold to state agencies and public colleges. Reports are available to current customers through a shared profile, and the page documents no other route to them.

Data location is sold as a paid control. Premium Assurance lets a customer store data in the US, Australia, the EU, India or Canada, which UpGuard positions against GDPR and APRA obligations, and the pricing page marks data residency as an additional cost.

The research team's data handling is written down in unusual detail. The guidelines state that analysts only research publicly accessible data, that no analysed data is uploaded to cloud services, and that on purge the decryption key is deleted and overwritten before the encrypted container is destroyed. [s10, s12, s8, s15]

Add analyzed competitors to compare them side by side with UpGuard.

UpGuard's declared target and its named customers pull in different directions. Its chief executive told Startup Daily the Series C accelerates enterprise-grade solutions for the mid-market, and the Bitsight comparison page says UpGuard fits mid-market teams that deploy quickly. The same page names Intercontinental Exchange, Morningstar, TDK, PagerDuty, Hopin and IAG as customers.

Industry pages carry the vertical story. UpGuard publishes industry pages for education, financial services and technology, and its compliance pages address ISO 27001, NIST, DORA, the SIG questionnaires and APRA CPS 230, which is the obligation set a regulated buyer arrives with.

Geography is split between two homes. Startup Daily reports the company is headquartered in Hobart, Tasmania with US headquarters in Mountain View, California, and the chief executive is quoted saying the business has customers in 90 countries and staff in 14.

G2's reviewer profile is the one segmentation record UpGuard does not write. It counts 282 reviews from companies of 51 to 1,000 employees and 77 from companies below 50, spreads them across Asia, North America, ANZ and Europe, and names financial services 64 times against 63 for information technology services.

The scanning and scoring engine is the capability the ratings run on. UpGuard describes proprietary scanning infrastructure collecting billions of data points daily through commercial, open-source and proprietary methods, focused on non-invasive passive collection, and says it monitors billions of data points across millions of companies.

The score is specified rather than asserted. Checks feed a rating out of 950 per internet-facing property, points are subtracted by severity and weight, the organization-level score is a Gaussian weighted average that gives the lowest asset score the most weight, and the checks inside each of ten categories carry fixed weights. UpGuard says its in-house research team adds new checks over time and changes the algorithm with them.

AI is scoped to named jobs. Threat triage, document analysis behind the security profile, and questionnaire autofill are each described as specific tasks, and UpGuard publishes its own usage measurements, including more than 100 billion risk signals a day and 23 billion tokens processed in 100 days.

In the reviewed sources, one third-party evaluation of this market ranks the product and one analyst market guide lists it. Forrester's 2024 cybersecurity risk ratings evaluation ranked UpGuard a Contender, a tier below the Strong Performers and outside the leaders, and the Information Security Media Group report on it names UpGuard once, in that tier list. Forrester published a further edition of the evaluation in April 2026, and UpGuard separately announced a Representative Vendor listing in a 2022 Gartner market guide for IT vendor risk management.

The motion starts with free software and published prices. Trust Exchange is free with no credit card and no sales call, a free tier monitors up to five vendors, and paid plans are listed rather than quoted, which UpGuard contrasts with rivals on its own comparison pages.

Research is the attention engine. The breach research index publishes dated investigations under a named author through 2025 and 2026, and the guidelines state that UpGuard works with media under embargo and never approaches a breached entity in a sales capacity, which separates the research brand from the sales motion in writing.

Proof for buyers is a library of named references. Case studies name Morningstar, Colorado State University, St John WA and Intercontinental Exchange, and G2 carries 735 reviews of Vendor Risk at 4.5 out of 5.

Vendor Risk is the priced anchor. The Standard plan is $1,750 a month billed annually and monitors 50 vendors, additional vendors cost $79 a month, and the Professional, Corporate, Enterprise and Enterprise+ tiers move to contact-sales pricing while adding vendor slots, fourth-party visibility, audit logging and multi-org accounts.

Packaging separates the products a buyer can start with. Trust Exchange is free, with premium features such as custom domains and white labeling behind a paid plan, and the Bitsight comparison page says one license covers both monitoring and assessments.

Enterprise controls are a paid tier of their own. Premium Assurance carries data residency, a designated customer success manager and priority support, and the pricing page marks data residency as an additional cost on top of it.

The platform is software the customer's team operates. UpGuard runs it on Google Cloud Platform, ships from Kubernetes containers on a fortnightly release cycle, and states that operating the platform does not require a professional services engagement.

A human assessment service exists beside the product rather than inside it. UpGuard allocates a designated analyst who collects documentation, liaises with vendors and performs an in-depth risk assessment, and markets it for assessment backlogs, program launches and audit preparation.

Support is tiered with the plan. Standard support carries defined response times on the lower plans, and Premium Assurance adds accelerated service levels, a designated customer success manager and extended weekday technical support.

What UpGuard documents about itself is enterprise assurance plus one state certification. The security page states SOC 2 Type II compliance with annual attestation, a security program maintained in alignment with ISO/IEC 27001, encryption at rest and in transit, and annual third-party application penetration testing. A separate announcement records TX-RAMP certification in August 2023, under the Texas program for cloud services sold to state agencies and public colleges.

The attestation goes to customers rather than to the public. UpGuard says a current customer can access its reports through a shared profile, and its security page documents no other route to them. The same page states that the company runs no bug bounty program and pays no monetary rewards for findings.

The research team's handling of other people's data is the most specific commitment on the site. The guidelines state analysts only research publicly accessible data, never crack third-party encryption, keep downloads on physical media, and delete the decryption key and overwrite the container once no involved party still needs the data.

The platform is built to push its findings outward. UpGuard documents a REST API and webhooks, and says Risk Automations adds more than 100 native integrations including Jira, ServiceNow, Microsoft Entra, Slack and Cloudflare.

Automation is positioned as the difference between reporting and resolving. UpGuard describes turning a risk signal into vendor onboarding, score-drop triage, ticket creation, alerting and system-level actions such as blocking an address or forcing a credential reset.

Trust Exchange extends the platform to the other side of the transaction. A supplier answers questionnaires and publishes a trust page at no cost, which puts UpGuard in front of organizations that are not its customers.

The founding pair and the current roster are separate records. Startup Daily reports UpGuard was founded in 2012 as ScriptRock by Mike Baukes and Alan Sharp-Paul, the 2021 SEC Form D lists both as executive officers, and the about page today names Mike Baukes as co-founder and chief executive, with no role recorded there for Sharp-Paul.

The executive team is published as names and titles. Chief product, operating, financial, information security, marketing and revenue officers each appear on the about page, along with a chief of staff, and no prior role is recorded for any of them there, so their track records are not part of what that page offers a reader.

The research team is the part of the organization with a public output record. Its guidelines describe a documented breach research process reviewed quarterly with outside counsel, and its index carries dated investigations under a named author.