Enterprise DNA

Instead of UpGuard Vendor Risk

Stop renting your UpGuard Vendor Risk review desk. Own your supplier security record.

We build your version around the services your suppliers deliver, bring your UpGuard vendor records across and run the review desk for you. Connect the monitoring service your business needs as part of your custom version.

UpGuard Standard lists US$1,750 a month billed annually, or US$21,000 a year, for 50 monitored vendors. That includes monitoring as well as assessment work. The free version here covers the assessment desk.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

Before the next renewal

Separate the monitoring service from the review work

Compare your subscription with the work your team actually does each week. An external security rating and an internal approval record do different jobs.

paid

An annual commitment

Standard is US$1,750 a month on annual billing. Review the whole annual commitment alongside the services you use.

group

A monitored-vendor allowance

Standard covers 50 monitored vendors. Each additional monitored vendor is listed at US$79 a month.

assignment

Assessment administration

The subscription includes assessment and remediation workflows. These hold the questions, findings and decisions your team works through.

account_tree

The providers behind your suppliers

Fourth-party features are listed from Corporate. Your owned version can hold declared dependencies and show shared-provider exposure.

badge

Different access tiers

Role-based accounts appear from Professional. Enterprise DNA sets access around the people who need your custom version.

monitor_heart

Monitoring has its own job

UpGuard supplies external security ratings and monitoring. Keep that service where you need it, or connect your chosen provider to the desk we build.

Your vendor review desk

Four weekly jobs, with the underlying records kept together

Review queue

Know what needs a decision

Prepare the review meeting from due dates, service criticality and named owners.

  • check Overdue and upcoming reviews in one list
  • check Unclassified suppliers called out before approval
  • check Service descriptions and personal-data scope recorded
  • check A Monday brief combining reviews, findings and shared providers

Evidence

Every positive answer needs support

Keep the source reference, reviewer and validity dates beside the answer.

  • check Five starter questions you can replace with your own
  • check Expired evidence blocks a positive decision
  • check Exclusions need a written reason
  • check A decision preserves the evidence used at that time

Remediation

An exception is not a permanent answer

Track each finding, its owner and the date a temporary acceptance runs out.

  • check Likelihood and impact recorded separately
  • check High-risk findings block approval without a valid exception
  • check Expired exceptions return to the attention list
  • check Open findings remain visible in conditional decisions

Dependencies

See the shared provider behind several services

Join declared dependencies to your own vendor records and service criticality.

  • check Direct and indirect provider relationships
  • check A count of affected vendors for each shared provider
  • check The critical services included in that exposure
  • check Dated imported ratings shown separately from internal review decisions

Make it yours

Design your own UpGuard Vendor Risk replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from UpGuard Vendor Risk. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your UpGuard Vendor Risk replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your UpGuard Vendor Risk data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Real answers from the demo data that ships with Vendor Cyber Risk for Claude Code. It runs in Claude Code inside the Claude app, so it feels like any chat you already use.

forum

Vendor Cyber Risk for Claude Code

Connected to your own database

Which supplier reviews and exceptions need attention today?

New Partner

Issue
No review date
Owner
Unassigned

Harbour Cloud

Issue
Overdue
Owner
Moana
Due
2026-11-05

Tui Documents

Issue
Overdue
Owner
Moana
Due
2026-11-11

Kauri Support

Issue
Due soon
Owner
Ravi
Due
2026-11-23

Kauri Analytics

Issue
Due soon
Owner
Ravi
Due
2026-12-03

Harbour Cloud

Issue
Recovery test overdue
Owner
Moana
Due
2026-10-30

Kauri Support

Issue
Support access lacks review
Owner
Ravi
Due
2026-11-07

Harbour Cloud

Issue
Expired evidence: Recovery exercise
Owner
Moana
Due
2026-10-09

Kauri Support

Issue
Expired waiver: Temporary support exception
Owner
Ravi
Due
2026-11-11

Ask it anything

Ten questions for your own vendor review meeting

These questions run against the demonstration records today. Extend them around your own services and review rules.

chat_bubble Which reviews are overdue, who owns them and how critical are those vendors?
chat_bubble Which unresolved findings are overdue and no longer covered by an exception?
chat_bubble Which service providers do several critical vendors depend on?
chat_bubble Which imported ratings are stale or missing?
chat_bubble Which suppliers handle personal data without current evidence of safeguards?
chat_bubble Which overseas arrangements have no recorded disclosure or processing rationale?
chat_bubble Which assessment answers rely on expired evidence?
chat_bubble Which findings are temporarily accepted, and until when?
chat_bubble What exact evidence and findings supported a past decision?
chat_bubble What needs the Monday meeting across review dates, risk and shared providers?

Switching

How to switch from UpGuard Vendor Risk

The move involves exporting the vendor records UpGuard makes available, testing the import, then checking the new desk alongside your current process before you switch.

  1. 1

    Get the vendor export

    Use UpGuard's documented bulk vendor export, in CSV or raw vendor JSON if your account allows it. Include vendor names, primary domains, score observations and labels. Those are the four fields in the documented vendor export. Questionnaire history, evidence files, prior decisions and exceptions are not included, so note any other records you want to retain before you move.

  2. 2

    Test the import

    Have Claude Code run the UpGuard import as a test first, using the real date of the export. Review the test result before importing the records for real. This lets you see how the vendor data maps into the new desk without treating the test as your completed migration. If the export contains more than one kind of record, confirm which records the import accepts.

  3. 3

    Check flagged records

    Compare the test result with the UpGuard export. Check that the vendor names, primary domains, score observations, labels and observation date are represented as expected. Review any records the import flags, and check the source record if something is missing or unclear. Resolve questions before you accept the import, so you know what is in the new database and what still needs separate handling.

  4. 4

    Run both side by side

    Keep UpGuard available while you check the new desk against your current vendor review work. Confirm that the records you need are present and that your team can follow its review process in the new desk. Imported ratings are dated observations, not live monitoring. If you rely on monitoring, keep the required monitoring provider in place during the move and afterwards.

  5. 5

    Switch off UpGuard Vendor Risk

    When you have checked the imported records and are ready to use the new desk, end your UpGuard Vendor Risk use. Keep any monitoring service you still require, since the new desk does not recreate UpGuard's internet ratings, continuous scanning or Trust Exchange network. Retain the UpGuard export and any separately gathered history you need according to your own record-keeping practices.

construction

Where the real effort goes

The export is the straightforward part. Most of the work is mapping your own fields, questions and approval rules, then deciding which questionnaire history, evidence, prior decisions and exceptions to bring across. The documented vendor export does not include that history. If you have Enterprise DNA run your version, Enterprise DNA handles this mapping and checks the result with you.

Not ready for a call?

Get your UpGuard Vendor Risk switch plan by email

We will send you the step-by-step plan for moving your business off UpGuard Vendor Risk, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Choose how you want it run

Three ways to own your vendor review desk

Open source

Do it yourself

Free, open source

  1. 1 Clone the repo and install Node dependencies
  2. 2 Run the demo, tests and branded reports
  3. 3 Import your UpGuard vendor export and check the counts
  4. 4 Use Claude Code, Codex, OpenCode or Cursor to adapt the questions and rules
Get the free version

Built around your business

We customise it

Scoped to your business

  • check Your security questions, review intervals and approval rules
  • check Your UpGuard records mapped and checked
  • check A web front end or a different technology stack when needed
  • check Your chosen monitoring service connected to the review record
Get your version built

Omni by Enterprise DNA

We run it for you

One setup fee, then a retainer

  • check Installed and operated through Omni by Enterprise DNA
  • check Your evidence storage, access controls and backups set up
  • check Your review packs and management reports kept useful
  • check Your version maintained as suppliers and requirements change
Talk to Sam

Questions

Instead of UpGuard Vendor Risk, answered

Does the free version replace UpGuard security monitoring? expand_more

The free version manages vendor assessments, evidence and follow-up work. Imported security ratings are dated observations. UpGuard also supplies live monitoring and its own scoring service. Enterprise DNA connects the monitoring provider you choose when building your version, so the review record and current monitoring have clear sources.

What actually comes across from UpGuard? expand_more

The documented vendor export carries names, primary domains, rating observations and labels. The free version imports those records and keeps their observation date. Questionnaire history, evidence files, prior decisions and exceptions are outside that export. We map those separately from the records your account can supply, then check the result with you.

Will it tell me a supplier is safe or compliant? expand_more

It checks the records supporting a review. Missing safeguards evidence, unanswered questions and expired exceptions are surfaced for a person to assess. The checks cite New Zealand and Australian privacy guidance. A completed review records a human decision; it is not a security certification or a legal ruling.

Can we use our own questions and approval rules? expand_more

Yes. We build your version around the services your suppliers provide, the information they handle and the people authorised to decide. Your questions, review intervals and exception rules belong to you. We can add the intake forms, access controls and reports your team needs.

What does Enterprise DNA charge, and what other costs remain? expand_more

There is one setup fee, then a retainer to run your version through Omni by Enterprise DNA. We agree the scope with you. Hosting, the tools used to operate it and any external monitoring remain part of that scope. The open-source software itself has no per-vendor licence fee.

Bring the renewal and one difficult vendor review

In a 30-minute call, Sam will walk through what you pay for, which supplier records you need to keep and how your own version would handle the work. Start with the assessment your team is struggling to finish.

Book 30 minutes with Sam Get the free version

Vendor Cyber Risk for Claude Code is free and open source, published by Enterprise DNA.

Done paying for UpGuard Vendor Risk?

Get your version built