OWASP DefectDojo vs UpGuard
OWASP DefectDojo
defectdojo.com
UpGuard
upguard.comSide by side
| Figure | OWASP DefectDojo | UpGuard |
|---|---|---|
| Price from | $100/mo | $1,750/mo |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 5 | 6 |
| Spec score · Vulnerability Management Software | 8.9 (#2) | 8.7 (#4) |
| Integrations | The vendor lists more than 500 supported security tools, including SAST, DAST, SCA, cloud, container, modeling, and ticketing systems. | Native integrations include Jira Cloud, Slack and ServiceNow, while Zapier connects UpGuard with more than 4,000 applications. |
| Rating on G2 | 4.6 out of 5 from 11 reviews | 4.5 out of 5 from 802 reviews |
| Rating on Gartner Peer Insights | 4.5 out of 5 from 4 reviews | 4.6 out of 5 from 243 reviews |
| SDKs | The DefectDojo GitHub organization publishes a Python API library named defectdojo_api and a Go installer named godojo. | UpGuard documents curl, jq, Python Requests and Postman usage, but the reviewed pages do not identify an official SDK package. |
| Security compliance | DefectDojo states that it maintains a SOC 2 Type 2 attestation and aligns its trust program with GDPR and the EU Cyber Resilience Act. | UpGuard states that its security program aligns with ISO/IEC 27001 and that it is SOC 2 Type II compliant with annual attestation. |
| Support | Community users are directed to GitHub, Slack, and forums, while Pro subscriptions include unlimited support tickets and dedicated engineering attention. | The pricing comparison lists Standard Support in Standard, Professional, and Corporate, and Premium Assurance in Enterprise and Enterprise+. |
| What it does | DefectDojo aggregates security findings, deduplicates them, prioritizes risk, and supports remediation and reporting. | UpGuard is a cloud platform for managing vendor risk and monitoring external attack surfaces, with questionnaires, security ratings, continuous monitoring and alerts. |
Plans
OWASP DefectDojo
- Community EditionFree
- Pay As You Go$100 a month
- Pro Pay As You Go$100 a month
- Pre-Pay & SavePrice not published
- Pro Pre-PayPrice not published
UpGuard
- FreeFree
- Standard$1,750 a month
- CorporatePriced on request
- EnterprisePriced on request
- Enterprise+Priced on request
- ProfessionalPriced on request
In their own words
OWASP DefectDojo
OWASP DefectDojo gathers security scanner findings, deduplicates them, helps teams prioritize risk, and supports remediation. It natively integrates with more than 500 security tools across SAST, DAST, software composition analysis, cloud, and container categories. Community Edition accepts integrations through file import or API push and includes bidirectional Jira support; Pro adds more scheduled-pull connectors and ticketing options. Pro also enriches findings with EPSS and CISA KEV threat intelligence, supports automated triage rules, and offers governance features such as single sign-on, granular access controls, audit trails, and SLA enforcement. Sensei can ship fixes as pull requests. The product can be self-hosted or air-gapped, with data export through a documented REST API. Community Edition is free forever, with support through OWASP Slack and GitHub. Pay As You Go costs $100 a month plus $0.15 per finding processed; Sensei AI is billed per use. Pro Reachability is labeled beta, with five verdicts and KEV overriding the ceiling.
UpGuard
UpGuard is a cloud platform for managing cyber risk across an organization’s vendors, digital footprint, and workforce. Vendor Risk supplies continuous vendor insights, assessments, and AI-powered workflows. Attack Surface Management monitors an organization’s digital footprint to help detect threats, while Trust Exchange provides questionnaire automation, a Trust Page, and collaboration features. The platform supports remediation tracking and advanced risk prioritization, with access through web and API. Listed integrations include Jira Cloud, Slack, and ServiceNow, plus connections to more than 4,000 apps through Zapier. Vendor Risk tiers list API access and SSO. Standard covers 50 vendors; Enterprise+ includes unlimited vendors and platform users. The free plan is available, and paid plans start at $250/mo. Standard is listed at $1,750 a month when billed annually. UpGuard says customer data is encrypted at rest and in transit, and its security program aligns with ISO/IEC 27001; it also reports SOC 2 Type II compliance and annual attestation.