SecurityScorecard vs. UpGuard Vendor Risk vs. Vanta

Good:

* Initial recognition of perimeter

* Discovery of shadow IT assets

* Get nice reports to set baselines and objectives for your customers

Bad

* Does not provide threat intel as another tool

* Not enough documentation for the API or to automate scenarios

Incentivized

UpGuard Vendor Risk is great when we need a quick view of a vendor’s external security posture, especially during fast-paced onboarding. It’s also very useful for continuous monitoring with visibility into changes at Vendor's side without repeatedly chasing vendors for updates. The only scenario it is not very helpful, is small vendors / start ups that dont have an external footprint, but in that case the questionnaire's can be used.

Incentivized

Vanta seems excellent for startups, but I expect that they would be even more useful at bigger companies. I think it really helps people that haven't done SOC2 before. I also think it would help in monitoring compliance across teams with many users. If the budget is extremely tight, I think it would be possible to save money by not using it.

Incentivized

• Security Ratings
• Security Assessments
• Reporting Center

Incentivized

• Helped us automate our vendor risk questionnaires
• Helps us continuously monitor our high-risk vendors
• All vendor risk data is in one place, organized by risk level, criticality, and status

Incentivized

• API driven capabilities offer a very easy way to connect your systems to their application.
• It was mostly intuitive to figure out what needed to be configured.
• I like how responsive they have been and how they have been able to outline the entire process for us from the start to the end.

Incentivized

• Pricing could be reviewed for specific industries which were more impacted by the pandemic situation.

Incentivized

• Integration with GRC systems, ticketing platforms could be stronger
• More configurable dashboards will be helpful

Incentivized

• In my opinion, they make it very hard to contact them when you need something.
• In my experience, they write their contracts to make it difficult to cancel service.
• In my experience, they have no policy for refunds in addition to their [...] contacts.

Great to maintain for our SOC2 compliance and further compliance evolutions

Incentivized

It gives overall risk visibility into our supply chain

Incentivized

In my experience, the sheer volume of tasks and to do items is a bit inundating.

Always available

Incentivized

Fast although the agent may take some time to reping on checks

Incentivized

Direct support and replies in a timely manner to tickets submitted

Incentivized

Pretty straight forward

Incentivized

Straight Forward

Incentivized

Pretty seemless and did it almost entirely myself

Incentivized

n/a

Incentivized

We’ve evaluated other third-party security rating platforms, including those which focus heavily on questionnaires, self-assessments, and point-in-time reviews.
UpGuard's usp is continuous monitoring and external risk visibility, automated questionnaires, which reduced our reliance on manual follow-ups. That said, most tools in this space still need to be complemented with internal reviews and contract-level risk assessments, depending on the vendor and use case.

Incentivized

Vanta's reporting was far superior, the price was competitive but my engineers running the project said that working with vanta would save them significant amount of time. Secondly vanta had more integrations so they could plug directly into the systems we use!

Incentivized

Works as intended

Incentivized

• Get insights about our external security posture
• Actionable tasks to solve

Incentivized

• reduce the time and effort spent on vendor due diligence
• it has improved our ability to identify higher-risk vendors early and focus remediation efforts where they matter most, rather than treating all vendors the same
• more informed risk decisions

Incentivized

• We were able to close contracts because we had our SOCII compliance in place
• SOCII certification process was reduced by at least 80%

Incentivized