##### Press release

# UpGuard Names Public Documents Major Threat to Fortune 500 in New Report

##### [UpGuard Team](#)

March 1, 2021

UpGuard, the third-party risk and attack surface management platform, today published a study identifying an overlooked threat to Fortune 500 companies: public documents and PDFs. This study, conducted by the UpGuard Cyber Research [Team](https://www.upguard.com/breaches), shows that prominent companies are exposing information important to malicious actors during the reconnaissance phase of an attack. 

UpGuard conducted an analysis of Fortune 500 companies and reviewed the metadata associated with public documents on their websites. These files included PDF, Word, Excel, and PowerPoint documents. The findings of this report reveal that over half of the companies surveyed were not following important cybersecurity best practices, leaving them vulnerable to potential cyber attacks. 

Additional key findings from the study include:

\- The attack surface for each organization is vast, with Fortune 500 companies  having on average over 9700 public PDFs online on their public websites. 

\- Over 51% of the companies analyzed are exposing unnecessary and often sensitive metadata in their public PDFs and documents.

\- According to UpGuard’s analysis, this practice is only getting worse over time. There are more documents being uploaded over time and document sanitization has declined. Bad actors can have more information than ever before to launch a cyber attack. 

To access the full report, visit our resource center [here](https://www.upguard.com/resources/research-report-public-documents-used-for-attack-reconnaissance). You can also listen to firsthand analysis from Greg Pollock, VP of CyberResearch, as he discusses the report findings and how businesses can better adapt to this threat in this [video](https://www.youtube.com/watch?v=c1o3ufO73PU\&list=PLCnIo9FMH4A7bHQQ4yjX0IYTgUwSRQbNS\&index=2). 

About UpGuard 

UpGuard helps businesses manage cybersecurity risk. UpGuard’s integrated risk platform combines third-party risk management, security questionnaires, and threat intelligence capabilities to give businesses a full and comprehensive view of their attack surface.

### Sign up for our newsletter

UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.

## UpGuard blog

Learn about the latest issues in cybersecurity.

#### [PHP2Shell Is a Vendor Problem Too: How to Find and Close Third-Party Exposure](/blog/php2shell-third-party-exposure)

Your vendors run PHP too. Here’s how to find which ones are exposed to PHP2Shell and prove they’ve patched, using scanning and a vendor questionnaire.

[](/team/cassy-van-eeden)

[Cassy van Eeden](#)

November 2, 2026

#### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web)

Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure.

[](/team/lance-turner)

[Lance Turner](#)

October 14, 2026

#### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape)

UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why.

[](/team/cassy-van-eeden)

[Cassy van Eeden](#)

October 18, 2026

#### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained)

You scanned your domain. What do the results mean?

[](/team/lance-turner)

[Lance Turner](#)

October 11, 2026

#### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm)

We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four.

[](/team/cassy-van-eeden)

[Cassy van Eeden](#)

September 29, 2026

#### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026)

A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news.

[](/team/revashni-moodley)

[Revashni Moodley](#)

October 14, 2026

[View all blog posts](/blog)

## See UpGuard In Action

Book a free, personalized onboarding call with one of our cybersecurity experts.

[Contact sales](/demo)

[Free demo](/demo)

##### Free instant security score

## How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.

* Instant insights you can act on immediately
* Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities

[Free score](/instant-security-score)