Dual Security Rating Services provide real-time external visibility into every vendor's security posture without relying on questionnaires.
UpGuard provides comprehensive external security ratings across four key categories, giving you a validated outside-in view of your vendors' security posture on a 0–950 scale.
The Shodan SRS engine performs deep internet intelligence scanning with a proprietary five-category scoring system that evaluates vendor infrastructure from the attacker's perspective.
Vendors are automatically rescored on a schedule matched to their risk tier.
| Vendor Tier | Risk Level | Rescore Interval | Typical Vendors |
|---|---|---|---|
| Tier 1 | Critical | Every 30 days | Cloud infrastructure, payment processors, core SaaS |
| Tier 2 | Standard | Every 90 days | HR platforms, CRM systems, collaboration tools |
| Tier 3 | Low-Risk | Every 365 days | Marketing tools, office supplies, non-data vendors |
Features designed for real-world security operations.
Exclude specific findings per subdomain when a risk is accepted or represents a false positive. Waivers include documented reasons and are tracked in the audit log.
Green (80%+ positive), Yellow (50–80%), Red (<50%) at-a-glance ratings make it easy for non-technical stakeholders to understand vendor security posture.
Trigger immediate Shodan rescans when you need fresh data outside the automatic schedule. Results are available within minutes with full finding detail.
Admin-customizable point values per scoring category let you tune the Shodan engine to match your organization's risk appetite and security priorities.
Chart.js-powered visualizations show score history over time. Identify improving or degrading vendor security postures at a glance with trend lines.
Shodan's vulnerability category detects known CVEs on vendor infrastructure, with scaled penalties based on CVSS severity. Maximum penalty for CVSS 9.0+.
The Shodan integration intelligently handles vendors behind web application firewalls and content delivery networks, avoiding false positives from infrastructure that doesn't belong to the vendor.
See how continuous scoring fits into the complete vendor lifecycle from onboarding to annual review.
Explore Vendor Lifecycle