UpGuard Release Notes

Special thanks to our Beta customers who continue to provide valuable feedback as we continue to develop the UpGuard product to better serve your needs. 

Improved visibility of Questionnaire details within Shared Profiles

In this release we are shipping the first of many future improvements to the Shared Profiles functionality as we see this being something that can notably reduce the time it takes for you to consider, onboard, or review a vendor's security posture. First up we have improved the visibility of risks, scores and unanswered questions within Questionnaires in a vendor's shared profile.

Other improvements 

• Improvements to our web scanning services (focus on cloud service subdomains)
• Improvements to our domain scanning and verification
• Ability for customers to see UpGuard CyberResearch services.

Learn about new features, changes, and improvements to UpGuard this month:

Zapier integrations now available

We've added support for integrating with Zapier, an automation platform that connects to thousands of apps. If you have a Zapier account, you can now connect UpGuard to any other app that Zapier supports. For example, you could monitor new vendors in UpGuard when a Google Form is submitted, or get a phone call via Twilio when new data leaks are detected.

Check out our Zapier Integrations page for more workflow examples and read our guide to get started.

New page header design

In this release, we've revamped the design of our page headers to make it easier to find information relating to the page you're looking at.

Every page now has an information (i) icon that will show you a brief overview of what you can do, along with page-specific links to our Knowledge Base for further information.

When viewing pages related to vendors, the new page header also allows you to see vital information at a glance, such as vendor tiers and labels, and gives a consistent way to perform vendor-specific actions such as generating a vendor report.

We've also added breadcrumbs to help give context as to the location of the current page within our page hierarchy.

Help & Support menu

We've added a new Help & Support menu, which can always be found at the bottom left of your screen. You can use this menu for quick access to our Knowledge Base, to view our latest release notes, or to contact our sales and support teams.

Changes View export

When viewing the changes over time for your own organization, a subsidiary, or a vendor, you can now export this view to PDF. Simply click the Export button while viewing changes on the Risk Profile page.

Other fixes and improvements

• Viewing "passed checks" in the Risk Profile and Questionnaire screens now includes checks passed in in-built questionnaires
• Improve detection of wildcard subdomains

In this release, we've added more fine grained control over custom notifications in the platform. Custom notifications now support additional filtering based on vendor tiers, vendor labels, or domain labels.

Any number of these custom notifications can be created in an account, giving you the flexibility to set up alerts for vendors or domains you care most about, and avoid notification fatigue.

For example, you could now set up a notification to fire when any of your Tier 1 vendors (who you have also labelled as managing customer data) have a score drop of more than 10 in the last week. Such a notification type could be used for in-app notifications or emails for any member of your account, or even for a webhook integration.

Learn more about creating custom notifications here.

Other fixes and improvements

• Avoid false positive detection of domain registrar protection risks
• Remove some duplicate SSL risks when certain risks are already present
• Improvements to initial scans for vendors and their subsidiaries

In this release, we've added the ability to share a public link to your Shared Profile. By embedding the public link on your website or email signature, anyone who follows the link will be able to sign up for a free UpGuard account to view your Shared Profile. If your Shared Profile is available by request only, you'll still be asked to approve access on an individual basis.

Publishing a public link to your Shared Profile is another way you can proactively share your security posture and related documentation with current and prospective customers, and means you can spend less time filling out manual assessments.  It can also help you close deals faster by skipping a typically slow part of the sales process. To see a great example of a public security page that includes an UpGuard Shared Profile, take a look at this one by Built Technologies.

To get started, publish a Shared Profile and read more about how to share a public link.

Other fixes and improvements

• Remediation requests will now be automatically marked as complete when all risks are remediated
• Significantly improved performance of Identity Breaches feature
• Improvements to IP address attribution
• Fixed issue where small nations would not appear on IP geolocation maps

Learn about new features, changes, and improvements to UpGuard this month:

Calculate potential score changes with the remediation planner

Many customers have let us know that they would like more visibility into how fixing specific risks would impact their or their vendors' scores. Based on this feedback, we have added a new score projection into the remediation module.

Now, when creating a remediation request for your own organization, a subsidiary, or a monitored vendor, you can see an estimate of how the score will change if all requested risks are remediated.

Recipients of remediation requests will also be able to see the score projection, helping them to understand the impact that each risk has on their overall security posture.

To get started, create a new remediation request and read more about the remediation planner.

Vendor tiering

In this release, we've added a new way for you to organize your vendors. Vendor tiering allows you to classify your vendors based on the inherent risk they pose to your organization, and adjust the level of assessment you do on each vendor as a result.

For example, you may wish to classify a vendor that handles internal company communication as Tier 1, and a vendor that only stores publicly accessible information as Tier 3. When assessing each vendor, you could then elect to send detailed questionnaires to Tier 1 vendors, whilst assessing just based on web risks for Tier 3 vendors.

Once you have assigned tiers to your monitored vendors, you can easily filter the Vendors list by tier, and see a vendor's tier when viewing any vendor-specific page in the platform.

Learn more about how to use and configure vendor tiering here.

Include your subsidiaries in the BreachSight Executive Summary

If your organization has subsidiaries, you can now include them in the BreachSight Executive Summary, to get a full high level overview of your entire organization structure.

Overall risk breakdown, security rating distribution, highest vs lowest rated organizations, competitor analysis, risk category breakdowns, and geolocation risk reports are all supported.

To get started, navigate to the BreachSight Executive Summary and select the "Organization and subsidiaries" tab.

Other fixes and improvements

• Remediation requests can now be saved as a draft before submitting
• Recipients can be removed from an existing remediation request
• A new scoring algorithm is now in use for all customer and vendor scores
• Vendor Comparison is out of beta and now available to all customers
• Fixes to how risk waivers are incorporated in various screens

You can now compare the security posture of up to four vendors side-by-side and dive into the details to see which vendor represents the lowest risk. Comparing vendors is a great way to communicate the security posture of new vendors to stakeholders prior to onboarding the vendor. It's also a great way to see how your current vendors stack up against potential alternatives that may offer improved security.

This feature is currently in beta. If you would like to join the beta prior to the official release, please reach out to us.

When you compare vendors, you'll be able to see their overall security rating, average rating across their industry, as well as their rating across each risk category. This gives you a great, high-level view of their security posture.

If you want to dive deeper, you can scroll down to see their overall security rating over the last month, quarter, and year, as well as a breakdown of the number and severity of risks across their risk profile.

Below this, you'll get a breakdown of the number and severity of risks across each risk category, as well as a summary of all the assets associated with each vendor and general information about the vendor.

And if you need to communicate the comparison to stakeholders, simply click Export in the top-right corner of your screen to generate a downloadable PDF report that outlines everything shown on the page.

Learn how to compare vendors and export a vendor comparison report.

Due date, reminder date, and ability to update the title of remediation requests

Based on your feedback, we've made two improvements to our remediation request feature this release:

• Due date and reminder date: You can now set a due date and reminder date when creating remediation requests. Once set, UpGuard will automatically notify the vendor via email on the specified dates ensuring that your remediation requests are actioned.
• Update title of remediation request: You can now update the title of a remediation request after it has been created.

Learn how to send an internal remediation request or a vendor remediation request.

Other fixes and improvements

• You can now create a custom notification for when a vendor's score increases by X in Y days.
• Improved the design of the modal you see when you first monitor a vendor
• Added API support for vendors with no web presence
• API activity now generates audit log events
• Added support for retrieving a list of introduced and resolved risks from monitored vendors via the API

Learn about new features, changes, and improvements to UpGuard this month:

We've added support for viewing a vendor and its subsidiaries in its Risk Profile.

This view lets you see all the risks present across the vendor and its subsidiaries. Each of the identified risks has a severity, name, risk type, category, and a number of organizations impacted. By default, findings are sorted by severity, with critical severity items at the top.

You can drill down into each identified risk to see the impacted organizations and their associated domains. However, you will need to be monitoring the subsidiary as a vendor to request remediation or to waive the risk. You can do this by clicking Monitor vendor.

Additional SSL-based checks

We've added support for three new SSL-based checks:

1. Untrusted SSL certificate (informational severity): The certificate presented by this domain was not issued by a trusted certificate authority and therefore cannot be verified by browsers.
2. SSL certificate chain missing from server response (medium severity): There is an invalid or missing intermediate certificate. This can cause some browsers to break the padlock. An intermediate/chain certificate may need to be installed to link it to a trusted root certificate.
3. SSL expiration period longer than 398 days (medium severity): Certificates issued on or after September 1, 2020 must not have a validity period greater than 398 days. The certificate will need to be reissued with a maximum validity of 397 days.

Other fixes and improvements

• Creating vendors with no web presence is now available for all customers with vendors
• Added notification for news articles in Incidents & News
• Increased upload limit from 10MB to 50MB
• Added highlight for news articles tagged as Advisory in Incidents & News
• Improved handling of WAFs and CAPTCHA for our automated scanning engine
• Fixed issue causing inactive subdomains to not be scanned in some situations

Now when you send a vendor a questionnaire through UpGuard, they'll be prompted to create a free Shared Profile that lets them proactively share their security rating, completed questionnaires, and other security documentation.

If a vendor chooses to create one, it will drastically cut down the time it takes for you and other UpGuard customers to assess them in the future. It also benefits the vendor as they'll spend less time filling out the same questionnaire while ensuring their customers have an accurate and up-to-date view of their security posture.

Vendors will be able to publish the following information on their Shared Profile:

• Security ratings: Toggle the inclusion of their own and their industry average security rating. Learn more about security ratings here.
• Security contact: Share contact information for the team or key employee who is responsible for security.
• Company description: Help users quickly understand what the vendor does.
• Security questionnaires: Proactively share complete security questionnaires to reduce time spent on answering similiar assessments.
• Supporting documentation: Share security-related documentation or compliance certifications such as PCI DSS, SOC 2, ISO 27001, FedRAMP, etc.

Learn more about Vendor Shared Profiles.

You can now add and assess vendors with no web presence. Prior to this release, vendors needed a website to be added to UpGuard. Now you can add any vendor you like, even if they don't have a website.

This is great for situations where you need to assess an independent contractor who doesn't have a web presence but will handle your organization's sensitive information. Once you've added them as a vendor with no web presence, you'll be able to send them a questionnaire and assess them based on their responses. You'll also be able to add contacts, upload additional evidence, and perform a risk assessment inside UpGuard.

This feature is currently in closed beta. If you would like to beta test the feature, please contact us.

Learn how to create a vendor with no web presence.

Improvements to the questionnaire process for customers

In May, we rolled out an improved questionnaire experience for vendors that was designed to reduce the time it takes for you to get a complete and accurate questionnaire.

In this release, we're taking what we've learned from that process and applying it to the customer-facing experience. The new page replaces, improves, and streamlines our previous questionnaire details page.

You can now quickly see the progress of the questionnaire, view unanswered questions, and view any associated remediation requests you have created. Messages now appear in the top-right corner of your screen which makes it simple to respond to any vendor queries.

The page has been split into three separate tabs:

1. Overview: Questionnaire metadata, progress, remediation requests, and unanswered questions.
2. Documents: Any attached documents
3. Timeline: The version history and timeline of the questionnaire

Other fixes and improvements

• Any users that are invited to a questionnaire or remediation request will now appear in the timeline
• Added support for retrieving all risks for an organization via the API
• Added support for IP addresses in the risks diff API
• Fixed issue causing domains parked at Gandi to be marked as active rather than inactive
• Added questionnaire designed to determine exposure to the recent supply chain ransomware attack that impacted Kaseya VSA
• Fixed issue causing questionnaire reminders to not be sent if one or more emails associated with the reminder bounced
• Added modal to inform you when you've hit your vendor limit
• Fixed issue causing security ratings and labels to not appear in domain view from a risk assessment