ThreatWatch vs UpGuard

ThreatWatch is a web-based platform for monitoring third-party vendor risk. It tracks breaches, dark-web exposure, attack-surface vulnerabilities, and compliance gaps, then assigns each vendor an A-to-F grade using threat intelligence, security scanning, questionnaire responses, and certifications. A passive, outside-in free scan requires no signup or credit card and returns a grade in about 30 seconds. The catalogue contains 280,770 companies searchable by name, domain, or alias. Vendor staff devices are re-checked hourly, while leaked credentials are re-checked daily. Vulnerability matching is included on every plan, but ThreatWatch confirms a vulnerability only when it can read the exact software version. Alerts can be sent to Slack, Microsoft Teams, Jira, ServiceNow, PagerDuty, email, the app, or a generic webhook. Compliance AI supports PCI-DSS, ISO 27001, SOC 2, HIPAA, GDPR, and NIST CSF questionnaires, plus custom frameworks. AI Co-Pilot and Ask AI are available from Professional and above; proposed changes require human approval. A free plan is listed, and paid plan prices are on request.

UpGuard is a cloud platform for managing cyber risk across an organization’s vendors, digital footprint, and workforce. Vendor Risk supplies continuous vendor insights, assessments, and AI-powered workflows. Attack Surface Management monitors an organization’s digital footprint to help detect threats, while Trust Exchange provides questionnaire automation, a Trust Page, and collaboration features. The platform supports remediation tracking and advanced risk prioritization, with access through web and API. Listed integrations include Jira Cloud, Slack, and ServiceNow, plus connections to more than 4,000 apps through Zapier. Vendor Risk tiers list API access and SSO. Standard covers 50 vendors; Enterprise+ includes unlimited vendors and platform users. The free plan is available, and paid plans start at $250/mo. Standard is listed at $1,750 a month when billed annually. UpGuard says customer data is encrypted at rest and in transit, and its security program aligns with ISO/IEC 27001; it also reports SOC 2 Type II compliance and annual attestation.