Non-monitored vendors for a complete vendor inventory

Vendor Risk users can now store every third party in UpGuard, whether or not it is being monitored. Low-risk, rejected, retired and not-yet-assessed vendors sit alongside monitored vendors in a single list, so the vendor inventory no longer depends on spreadsheets or procurement systems to be complete. Non-monitored vendors keep their labels, tier, attributes and intake form, and can be promoted to monitored when a full assessment or continuous scanning is needed. Available on all paid plans. To learn more see Vendor Risk non-monitored vendors.

Security Profile assessment scoring improved

The Security Profile assessment rating has been improved to better weigh a vendor’s risks against how many checks they pass and how much evidence they’ve provided. Vendors who share more evidence get credit for the checks they pass, not just a deduction for every risk found. Existing published Security Profile risk assessment reports keep their previous score.

90 new experimental API endpoints

Security teams can now automate more of the UpGuard platform with 90 new API endpoints spanning Vendor Risk, Breach Risk, User Risk, Trust Exchange, and account administration. Highlights include:

• Managing vendor risk waivers and approvals
• Sending custom questionnaires and managing remediation requests
• A change feed across an organization’s monitored vendors
• Threat Monitoring auto-close rules
• Listing UpGuard users and roles for access reviews

These endpoints are currently released as experimental APIs and available upon request, and customer feedback will shape them as they move toward general availability. Customers can contact their Customer Success Manager for access.

Nudge and block counts for applications in User Risk

User Risk administrators can now see how many nudges and blocks an application or a user has triggered in the last 30 days. Open an application to see which of its users received nudges and blocks, then select a user to see the details of each event. The user list shows the same activity for every user.

PHP2Shell incident response questionnaire for vendors

Vendor Risk users can now send a PHP2Shell incident response questionnaire to vendors from the questionnaire library. Scanning identifies which vendors have the vulnerability, then this questionnaire covers where PHP is in use across their own and provider-run systems, the status and timeliness of patching, and whether exploitation could or has affected customer data or credentials. This questionnaire is recommended for all vendors that have the vulnerability, all critical vendors, and all vendors with your organization’s sensitive data.

Assign questions to specific users in Trust Exchange questionnaires

Trust Exchange users can now assign individual questions, or a whole section, to one or more collaborators when completing a questionnaire. Assigning a question to someone who is not yet a collaborator invites them. A new assignee filter in the questionnaire side panel shows each person the questions they own, and assignments appear in the questionnaire timeline. Recipients can also send private messages to each other within a questionnaire and use @mentions in questionnaire messages to tag recipients and senders.

Security Profile views by framework in Trust Exchange

Trust Exchange users can now filter their Security Profile by compliance framework, with ISO 27001:2022 and NIST CSF available, to see which controls their profile covers and where gaps remain.

Other improvements

• Vendor Risk and Breach Risk scans now detect UniFi OS hosts vulnerable to CVE-2026-34908, an improper access control vulnerability that enables unauthenticated remote code execution, together with CVE-2026-34909 (path traversal) and CVE-2026-34910 (improper input validation), which share the same patch. When these are chained together, they can be used to achieve an unauthenticated remote code execution on a host.
• User Risk administrators can now customize the nudge and block text shown to users.
• Trust Center access tables can now be sorted by column on the organisations tab.