[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Third-Party Risk Management](/category/third-party-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Can You Adjust Vendor Security Ratings?](/blog/can-you-adjust-vendor-security-ratings) Publish date September 20, 2026 {x} minute read # Can You Adjust Vendor Security Ratings? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/can-you-adjust-vendor-security-ratings) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Annie Luu](/team/annie-luu) Product Marketing Manager Table of contents eBook Can You Adjust Vendor Security Ratings? Free resource ### Can You Adjust Vendor Security Ratings? [Download now](/resources/can-you-adjust-vendor-security-ratings) Vendor [security ratings](https://www.upguard.com/blog/what-are-security-ratings) cannot be adjusted without modifying the criteria for evaluating a vendor’s [security posture](https://www.upguard.com/blog/security-posture). Ratings are one input to a [TPRM program](/tprm), not a substitute for the stages around them. Since the ability to make unmitigated adjustments violates the objectivity of security posture measurements, this functionality usually isn’t possible on security rating solutions. However, a workaround is to prevent certain discovered risks from influencing the calculation of a vendor’s security ratings. While this functionality isn’t available on all security ratings solutions, it's one of the many features offered on the UpGuard platform. UpGuard allows risk management teams to waive third-party security risks in two primary ways. ## 1. Waiving Risks from a Vendor’s Risk Profile On the UpGuard platform, a risk profile summarizes all the security risks associated with a particular vendor. Any risk can be disregarded by simply clicking the “Waive this Risk” button. [Learn how UpGuard calcualtes security ratings >](https://www.upguard.com/product/security-ratings) > Won’t this impact the objectivity of security posture measurements? To support objective and fair security posture calculations for each vendor, each risk waiver request needs to be approved before it's actioned. If the user doesn’t have the authority to approve a waiver, the request will be forwarded to those that do. Users submitting a request also need to provide a reason for the waiver. ## 2. Waiving Risks from Security Questionnaires UpGuard automatically lists a vendor’s security risks based on their questionnaire responses. Expanding the details of a particular risk will reveal an option to waive it, preventing it from influencing that vendor’s security rating. Once a waiver request is submitted, the user will be prompted to provide a reason to ensure all risk management team members and stakeholders are aware of the adjustment. ## Does Waiving Cyber Risks Support False Risk Fixes? No, when used in a platform with an objective and unbiased approach to risk remediation, such as UpGuard, waiving risk does not support fales risk fixes.  Besides the benefit of producing higher definition vendor risk profiles, increased cyber risk detection sensitivity means security teams might be presented with threats outside of their risk profile. This is where a feature like risk waiving becomes invaluable. Risk waivers allow security teams to instantly disregard detected threats that are not actually security risks - such as when compensating controls are in place. This feature has been specifically developed to streamline risk assessment workflow, not falsify fixes - a function that isn't even possible with UpGuard's risk-waiving feature. [See the UpGuard Risk Waiver feature in action >](https://www.upguard.com/demo) ## Adjusting Vendor Security Ratings with Additional Risk Evidence Vendor security ratings can also be adjusted by providing additional risk evidence to security rating solutions. This practice is encouraged since it increases the dimension of analysis of attack surface management, which increases the accuracy of this effort. On the UpGuard platform, additional evidence can easily be added to the risks influencing a vendor’s security rating by clicking the “Additional Evidence” tab in their profile. Under the additional evidence category, links to each vendor's publicly available security information can also be stored to simply [vendor risk assessment](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) efforts and provide greater context for all factors influencing a vendor's security ratings. If you’re new to the cybersecurity discipline of [attack surface management](https://www.upguard.com/resources/complete-guide-to-attack-surface-management), the following video will bring you up to speed. ## Why Would You Want to Waive Vendor Security Risks? There are many reasons why this functionality might be helpful in your [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management) program. These could include: * **Duplicate risk discoveries** - Duplicate or related security risks could have an excessively negative impact on a vendor’s security posture. This could result in a vendor receiving greater remediation attention, diverting the focus away from those posing real data breach risks. * \u200d**Superfluous risk discoveries** - Sometimes, discovered vendor-related security risks fall outside of your[ defined risk appetite](https://www.upguard.com/blog/risk-appetite-calculation-third-party-risk-management) and, therefore, can safely be accepted. > **Note:** All decisions to waive vendor security risks should be conducted through a Vendor Risk Management framework trusted by information security professionals and supportive of regulatory compliance. This will remove all bias from risk waiver decisions, ensuring vendor risk ratings are always adjusted toward greater accuracy. eBook Can You Adjust Vendor Security Ratings? Free resource ### Can You Adjust Vendor Security Ratings? [Download now](/resources/can-you-adjust-vendor-security-ratings) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Third-Party Risk Management #### [Ongoing TPRM Success: Continuous Security Monitoring with AI](/blog/continuous-security-monitoring-with-ai) Is manual work weighing down your security team and limiting your ability to scale? Learn how UpGuard and its AI features can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) September 29, 2026 Third-Party Risk Management #### [Report Writing Solved: Generating Actionable Assessment Reports](/blog/report-writing-solved) Is manual report writing slowing down your security team? Learn how UpGuard’s AI can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) April 2, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)