UpGuard is a cyber risk management platform for security and risk teams who need to see and reduce risk in three places at once: their vendors, their own internet-facing estate and their workforce.
A breach can start with a supplier, an exposed subdomain or an employee pasting data into an unapproved AI tool, and those risks usually sit with different teams and different tools. UpGuard puts them on one platform with one scoring model.
At A Glance
| Vendor | UpGuard |
|---|---|
| Category | Third-party risk, attack surface management and human risk |
| Deployment | SaaS platform with external scanning and API integrations |
| Agentic AI | AI Threat Analyst, AI triage in Risk Automations, Questionnaire AI, Shadow AI Monitoring |
| Customers | Chemist Warehouse, CFA Institute, Riverside County, St John WA, Anglo-Eastern |
| Founded | 2012 |
| Market classification | Governance, Risk & Compliance; also Vulnerability Management |
What UpGuard Does
UpGuard’s approach is to measure risk from the outside in and express it on a common scale. Findings about suppliers, the organisation’s own estate and its people all roll up into security ratings and a unified posture score, so a vendor, a domain and a user group can be compared directly. The same findings then drive action: they are pushed to the people and systems that fix them, and a single reporting view lets leadership follow progress without reconciling separate dashboards. The work also runs in reverse, helping a company answer the security reviews its own customers send.
Products
Vendor Risk
Vendor Risk is for teams running third-party risk programmes who are tired of chasing spreadsheets. It combines security ratings that quantify each vendor’s posture with continuous monitoring and automated security questionnaires, offering templates such as ISO 27001, NIST CSF, SIG Lite, SIG Core, DORA and APRA CPS 230. Each supplier’s assessment stays current between reviews.
Breach Risk
Breach Risk covers the organisation’s own attack surface. It finds hidden subdomains, shadow IT and misconfigured cloud resources, and fingerprints each asset against known vulnerabilities, misconfigurations and open ports. It also watches for exposure beyond the perimeter:
- Data leak detection for exposed PII, internal documents and proprietary data
- Dark web monitoring of marketplaces, forums and encrypted chat channels for stolen identities and leaked assets, with an AI Threat Analyst that evaluates incoming signals, dismisses a reported 68% of noise and explains the remaining risk in plain language
- Brand protection against domain impersonation and phishing infrastructure
User Risk
User Risk addresses the human side, giving security teams visibility of risky behaviour across the workforce. It includes Shadow AI Monitoring and policy governance, so teams can see which AI tools staff use and set rules for them. An AI Security Center and an AI Policy Generator for tailored AI usage policies support that work.
Trust Exchange
Trust Exchange helps vendors themselves pass security reviews faster. Questionnaire AI drafts answers to security questionnaires, and it hosts branded trust centres where customers can find security documentation.
Risk Automations
Risk Automations links the risk stack to other systems’ APIs so discovery, notification and remediation happen automatically, with AI triage deciding which risks need attention before they are resolved.
How It Works
UpGuard is delivered as SaaS and works largely from the outside in, building its picture of risk from what is visible on the internet and in threat sources, then routing the results to the teams that act on them.
| Component | What it does |
|---|---|
| External scanning | Breach Risk scans internet-facing assets daily and fingerprints what runs on each one. |
| Threat intelligence | Open, deep and dark web sources are monitored around the clock for leaked data and compromised credentials. |
| Scoring | Findings feed the security ratings and the unified posture score. |
| Automation | Findings are pushed into ticketing, chat and other tools, and the CyberRisk API supports custom integrations. |
Integrations
| Area | Integrations |
|---|---|
| Native | Jira Cloud, Slack, ServiceNow |
| Through Zapier | Google Docs, Google Sheets, Linear, Trello, Notion, Asana, Zendesk, Microsoft Teams, Microsoft OneDrive |
Company Background
| Offices | Hobart and Sydney, Australia, with a postal address in Mountain View, California. |
|---|---|
| Leadership | Mike Baukes (co-founder and CEO), Daniel Bradbury (Chief Product Officer), Harsh Sureka (Chief Operating Officer), Phil Ross (Chief Information Security Officer). |
| Funding | A reported $75M Series C (February 2026). |
| Customers | More than 45,000 reported customer companies worldwide. |
| Recognition | Included in the 2026 IDC MarketScape for Worldwide Third-Party Risk Management. |
Note: This overview is compiled from UpGuard’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.