Ability to conduct concurrent risk assessments for a single vendor

To give you more flexibility when conducting risk assessments, we’ve added the ability to create multiple concurrent risk assessments for a single vendor. You can now add custom names and scope for each risk assessment, to correspond to the specific purpose and scope of each assessment, such as product or region-based risk assessments.

To learn more about vendor risk assessments and these changes see How to complete a risk assessment.

Introducing the UpGuard Trust Exchange and Content Library

We’re consolidating our existing tools to answer security questionnaires, respond to requests for documentation and choose what to share in your Shared Profile under one banner: the UpGuard Trust Exchange. Plus, we’re introducing a content library, where you can manage and reuse previously uploaded documents.

• New: “Trust Exchange” menu item in your navigation
• New: Content library feature to manage and reuse documents uploaded as part of security questionnaires
• Move: “My Shared Profile” moves into Trust Exchange

Improved visibility into your asset inventory with Detected Products

To extend the visibility into your asset inventory in BreachSight, we’ve added a new section called Detected Products that displays in depth information about the software and other products used on your domains and IPs.

This information extends what is already available in Vulnerabilities – an inventory of software products with known vulnerabilities– to show products in use that may not yet have CVEs. Having this information allows you to audit for unapproved software and respond more quickly when a new vulnerability is discovered for one of the products you use.

Added link to registrar’s abuse page to typosquatting

When malicious domains impersonating your brand are detected by the Typosquatting module, the next step is to remediate the risk by contacting the domain registrar and reporting the abuse. You can now go straight to the page of the registrar or other relevant internet authority from Typosquatting to begin the takedown process.

Other improvements

• We have begun the process of rolling out credentials stolen by infostealer malware as an enhancement to Identity Breaches for all customers on the Professional plan and above.
• We have added detection for CVE-2024-1709 and other vulnerabilities in ConnectWise ScreenConnect.
• To make it quicker to download reports we’ve added the ability for users to download multiple reports at the same time from the Generated reports page
• This release includes a number of bug fixes.