- The team needs a first-party, agentless external attack-surface inventory with daily monitoring: Breach Risk automatically discovers and attributes external domains and IPs, applies non-intrusive public scanning, and refreshes monitored websites at least daily.
- Security and IT teams want prioritization and remediation workflow in the same first-party posture product: The product combines security ratings, CVSS, EPSS, KEV and verified-status context with remediation guidance, recipient assignment, due dates, waivers, tracking, and rescans.
Security & Privacy / Attack Surface Management (ASM) Software
UpGuard Breach Risk Review, Pricing, Pros & Cons
UpGuard Breach Risk, formerly called BreachSight, is an agentless SaaS product for first-party external asset discovery, daily domain and IP monitoring, vulnerability and configuration findings, security ratings, remediation workflows, and plan-dependent threat intelligence and integrations.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The requirement is internal authenticated scanning, endpoint protection, patch deployment, or exploit-based validation: UpGuard documents passive, non-intrusive external scanning and remediation coordination; those sources do not establish agents, authenticated internal scans, native patching, or continuous adversary emulation.
- The main purchase is third-party vendor governance, trust exchange, or analyst-led assessments: UpGuard assigns those jobs to Vendor Risk, Trust Exchange, and managed TPRM services rather than to the first-party Breach Risk ASM purchase.
- Employee-banded monthly Self-service pricing for organizations below 10,000 employees, a published starting annual price period for Standard, and contact-sales Enterprise pricing. Billing frequency does not establish commitment duration; add-ons, bundles, adjacent products, and managed services require separate commercial confirmation.
- Self-service · 250 · per subscription · per month · Breach Risk Self-service, 0 to 99 employees, monthly · billed monthly · month-to-month · minimum 1 subscription · Organization has 0 to 99 employees and purchases the current Breach Risk Self-service monthly state
- A current 14-day Breach Risk free trial is published; conversion, payment-card, market, and cancellation details are not stated on the plan table.
Product scope
Product functionality and purchase scope
This profile evaluates the current Breach Risk first-party external attack-surface purchase under the requested legacy BreachSight slug. It includes core ASM features and plan-dependent Threat Monitoring and platform controls only when the plan table grants them.
Product checked: Aug 10, 2026
- Breach Risk Self-service, Standard, and Enterprise SaaS plans
- Continuous agentless discovery and unlimited inventory of attributed external domains and IPs
- Daily passive scanning of public domains, ports, DNS, TLS, exposed products, and externally visible configurations
- Verified and version-inferred vulnerability findings with CVSS, EPSS, and CISA KEV context
- Security ratings, risk profiles, executive reporting, benchmarking, incidents, and news
- Internal remediation requests, remediation guidance, due dates, risk waivers, and owned-asset rescans
- Threat Monitoring, typosquatting, API access, and customer success management on Standard or Enterprise
- Audit log, advanced roles, asset portfolios, and subsidiaries on Enterprise
- UpGuard Vendor Risk third- and fourth-party risk management unless separately purchased or bundled
- UpGuard Trust Exchange trust center and questionnaire automation unless separately added
- UpGuard User Risk and Risk Automations unless separately purchased
- Managed Vendor Assessments and other analyst-led TPRM services
- Managed Data Leaks analyst service unless separately entitled
- Premium Assurance, regional data residency, and enhanced support unless separately ordered
- Internal authenticated vulnerability scanning, endpoint agents, EDR, SIEM operation, and patch deployment
- Active penetration testing, exploit execution, and continuous multi-hop attack-path validation
- Third-party Jira, Slack, ServiceNow, Zapier, and other destination subscriptions
Pricing checked: Aug 10, 2026
- Breach Risk self-service subscription: Employee-banded Self-service subscription for organizations below 10,000 employees.
- Breach Risk premium subscription: Sales-assisted Standard or Enterprise order with final scope, add-ons, and terms confirmed by UpGuard.
Pricing plans
UpGuard Breach Risk pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 98%3 linked sources
The current help-center table binds three Self-service monthly prices to employee-count eligibility and publishes Standard from $19,999 per year. Currency is retained as not stated because the source names no currency. Enterprise, add-ons, bundles, and adjacent products are quote-based. Annual price presentation is not treated as proof of an annual commitment.
Official pricing pageCommercial scope needs confirmation
Current official sources describe an offer or purchase route differently. The page remains usable, but affected price schema is withheld until the scope is resolved.
- A broad feature page states that monitoring starts at $5,000 per year, while the current dedicated plan table and billing guide publish Self-service from $250 per month and Standard from $19,999 per year. The detailed current plan states are retained and the older nonspecific amount is excluded.
- Official pages display dollar signs without naming a currency in the retained pricing statements. All four numeric offers are preserved with currency set to not stated.
PlanPriceKey differencesBest for
Self-serviceCurrent Breach Risk Self-service subscriptionSupporting pricing evidence
- 250 · per subscription · per month · Breach Risk Self-service, 0 to 99 employees, monthly · billed monthly · month-to-month · minimum 1 subscription · Organization has 0 to 99 employees and purchases the current Breach Risk Self-service monthly state
- 500 · per subscription · per month · Breach Risk Self-service, 100 to 999 employees, monthly · billed monthly · month-to-month · minimum 1 subscription · Organization has 100 to 999 employees and purchases the current Breach Risk Self-service monthly state
- 2000 · per subscription · per month · Breach Risk Self-service, 1,000 to 9,999 employees, monthly · billed monthly · month-to-month · minimum 1 subscription · Organization has 1,000 to 9,999 employees and purchases the current Breach Risk Self-service monthly state
- Included users: 3 users; Self-service plan.
StandardCurrent Breach Risk Standard premium subscriptionSupporting pricing evidence
- 19999 · per subscription · per year · Current Breach Risk Standard starting price · starting at · minimum 1 subscription · Current Breach Risk Standard premium plan
- final scope and price above the published starting amount require sales confirmation
- Included users: 6 users; Standard plan.
EnterpriseCurrent Breach Risk Enterprise premium subscriptionSupporting pricing evidence
- Requires quote · custom quote
- Included users: 20 users; Enterprise plan.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
Upgrade for more than three included users, Threat Monitoring, Standard Transforms, typosquatting detection, API access, or a customer success manager.
Supporting pricing evidenceUpgrade for 20 included users, audit logging, advanced roles and permissions, asset portfolios, or subsidiary monitoring as base entitlements.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
API accessRelationship not verified
API access begins with Standard and remains included in Enterprise.
Plan: Self-service: Not verified · Standard: Not verified · Enterprise: Not verified
Analyst-led managed assessments, Managed Data Leaks, and Premium AssuranceRelationship not verified
Managed vendor assessments are TPRM services, Managed Data Leaks includes analyst review, and Premium Assurance adds residency and enhanced support; none is assumed in Breach Risk.
UpGuard Services
Audit log, advanced roles, asset portfolios, and subsidiariesRelationship not verified
These administration and organizational controls are Enterprise base entitlements.
Plan: Self-service: Not verified · Standard: Not verified · Enterprise: Not verified
Open, deep, and dark web Threat MonitoringRelationship not verified
Premium plans include Threat Monitoring, two Standard Transforms, and typosquatting; Self-service does not.
Plan: Self-service: Not verified · Standard: Not verified · Enterprise: Not verified
Third- and fourth-party risk managementRelationship not verified
Vendor Risk is the third-party product and is not treated as a Breach Risk entitlement.
UpGuard Vendor Risk
Trust center and questionnaire response automationRelationship not verified
Trust Exchange is named as a paid add-on across premium plans, not included in Breach Risk base scope.
Plan: Standard: Not verified · Enterprise: Not verifiedUpGuard Trust Exchange
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 99%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 96%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 11 A2 official product sources are linked.
- 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- 2 non-blocking commercial scope issues require confirmation.
Discovery and attribution accuracy20%
81Multiple attribution signals combined with distinction between verified and version-inferred CVE findings improve discovery usefulness, yet buyers must still review false positives and ownership before treating results as definitive.
Exposure visibility18%
86Provides visibility through security ratings, risk profiles, executive reporting, and industry benchmarking data.
Risk prioritization17%
83CVSS, EPSS, CISA KEV context, security ratings, risk profiles, and industry benchmarking give teams concrete signals for ranking external findings, constrained by the absence of multi-hop attack-path exploitation proof.
Remediation operations14%
81Facilitates internal resolution through structured tracking, waiver options, and on-demand scans of owned assets to confirm remediated findings.
Scale and data freshness12%
86Unlimited domain and IP inventory on paid plans together with daily passive scans and continuous discovery keep external data fresh at scale, with Enterprise adding portfolios and subsidiary views for larger structures.
Integrations and reporting10%
72Standard and Enterprise add API access and integrations, and the product includes executive reports, but the lower plan boundary and unspecified integration breadth limit how far buyers can assume reporting and system connectivity go.
Support and total cost9%
71Provides clear monthly rates for self-service employee bands, but the Standard edition starting at $19,999 per year is a significant cost step and lacks public commitment details.
Public review signals
UpGuard Breach Risk has favorable but still limited exact-product review coverage
The retained exact-product G2 aggregate is favorable. Visible exact-product reviews praise continuous external visibility, understandable ratings, actionable findings, reliable alerts, integrations, and an intuitive interface; concerns include premium pricing, setup work for custom integrations, report complexity, passive-scanning limits, occasional asset-discovery gaps, and remediation that still occurs outside the platform.
Public review signals updated: Aug 10, 2026
Commonly reported strengths
- Clear security ratings and external attack-surface visibility
- Continuous monitoring, actionable findings, and reliable alerts
- Intuitive workflows and useful standard integrations
Commonly reported concerns
- Pricing can challenge smaller organizations
- Custom integrations and advanced reporting can require additional effort
- Passive scanning can produce unverified findings or miss assets that require manual review
G24.5/5
- Review count
- 22 reviews
- Source context
- UpGuard Breach Risk on G2Exact product
UpGuard Breach Risk tag profile
Company size
- Mid-market
- Enterprise
- Small business
UpGuard Breach Risk core capabilities
- Continuous agentless external domain and IP discovery
- Unlimited domain and IP inventory on all current paid plans
- WHOIS, DNS, mail, certificate-transparency, redirect, reverse-DNS, and certificate-based attribution
- Daily passive scans across ports, DNS, TLS, exposed products, and public configurations
- Verified and version-inferred CVE findings with CVSS, EPSS, and CISA KEV context
- Security ratings, risk profiles, executive reports, and industry benchmarking
Detailed strengths and purchase cautions
Why it is worth considering
- Enables continuous agentless external domain and IP discovery with an unlimited asset inventory across all current paid plans.
- Maps corporate asset attribution through multiple public records including WHOIS, DNS, certificates, and certificate-transparency logs.
- Streamlines exposure fix operations with built-in internal remediation requests, assigned due dates, waivers, tracking, and rescanning capabilities.
What to confirm before buying
- Generates version-inferred vulnerability findings via passive scanning, which can require manual ownership validation and false-positive reviews.
- Excludes essential capabilities such as threat monitoring, typosquatting alerts, API access, and advanced roles from the entry-level Self-service plan.
- Presents documentation discrepancies, maintaining an legacy annual pricing reference of $5,000 that conflicts with the newer employee-banded and Standard tier pricing.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 23, 2026
Score comparisonGPTGeminixAIRange
Discovery and attribution accuracy8280812
Exposure visibility8885844
Risk prioritization8185824
Remediation operations8580796
Scale and data freshness8785862
Integrations and reporting7275687
Support and total cost7470704
asm external asset discovery9390885
asm exposure risk assessment8685806
asm asset attribution accuracy8485832
asm remediation prioritization flow8380785
asm change monitoring alerts6870746
- Integrations and reporting: 68–75 (7-point range)
- asm change monitoring alerts: 68–74 (6-point range)
- asm exposure risk assessment: 80–86 (6-point range)
GPTAI-assisted buyer perspective82
UpGuard Breach Risk fits buyers that need continuously refreshed external asset discovery, vulnerability-aware exposure visibility, and remediation workflows in a single product, with plan checks for threat monitoring, API access, and enterprise administration before purchase.
- Review confidence
- 82/100
Model details
- Strengths
- It provides continuous agentless discovery of external domains and IPs, which supports first-party asset visibility without deploying agents.
- It combines daily passive scanning, verified and version-inferred CVE findings, security ratings, executive reports, and remediation requests in one workflow.
- It includes unlimited domain and IP inventory on current paid plans, which helps teams that expect growth in tracked assets.
- Cautions
- The Self-service plan does not include Threat Monitoring, typosquatting, API access, audit logging, advanced roles, asset portfolios, or subsidiaries.
- The published pricing record uses dollar signs without naming currency, and the Standard price is presented as a starting annual price without a stated commitment term.
GeminiAI-assisted buyer perspective81
This product delivers agentless external attack surface management with continuous discovery and passive scanning, though buyers should verify plan limitations as key operations like API access and advanced administrative roles require upgrading from Self-service to higher editions.
- Review confidence
- 81/100
Model details
- Strengths
- Enables continuous agentless external domain and IP discovery with an unlimited asset inventory across all current paid plans.
- Maps corporate asset attribution through multiple public records including WHOIS, DNS, certificates, and certificate-transparency logs.
- Streamlines exposure fix operations with built-in internal remediation requests, assigned due dates, waivers, tracking, and rescanning capabilities.
- Cautions
- Generates version-inferred vulnerability findings via passive scanning, which can require manual ownership validation and false-positive reviews.
- Excludes essential capabilities such as threat monitoring, typosquatting alerts, API access, and advanced roles from the entry-level Self-service plan.
- Presents documentation discrepancies, maintaining an legacy annual pricing reference of $5,000 that conflicts with the newer employee-banded and Standard tier pricing.
xAIAI-assisted buyer perspective79
Breach Risk fits organizations that need agentless first-party external domain and IP discovery, daily passive exposure monitoring, CVE context with ratings, and internal remediation workflows, with Self-service covering core needs for firms under 10,000 employees and Standard or Enterprise required for threat monitoring, API access, or advanced administration.
- Review confidence
- 79/100
Model details
- Strengths
- Continuous agentless external domain and IP discovery with unlimited inventory on all current paid plans supports ongoing first-party asset visibility without deploying agents.
- Daily passive scans cover ports, DNS, TLS, exposed products, and public configurations and supply verified plus version-inferred CVE findings with CVSS, EPSS, and CISA KEV context.
- Built-in remediation supports internal requests with recipients, due dates, guidance, waivers, tracking, and owned-asset rescans so teams can manage external findings inside the product.
- Employee-banded Self-service monthly pricing with a published 14-day free trial gives smaller organizations a defined entry path for core discovery, ratings, reporting, and remediation before adding premium capabilities.
- Cautions
- Self-service excludes Threat Monitoring, typosquatting, API access, audit logging, advanced roles, asset portfolios, and subsidiary monitoring, so those capabilities require Standard or Enterprise.
- Passive scanning can surface version-inferred vulnerabilities that still need ownership confirmation and false-positive review rather than exploit-based multi-hop validation.
- Published prices use dollar signs without a named currency, Standard’s starting annual price does not establish commitment duration or payment timing, and Vendor Risk, Trust Exchange, managed services, or destination integrations can add separate commercial cost.
- The product does not replace internal authenticated vulnerability scanning, endpoint protection, patch deployment, or third-party vendor-risk programs inside the base Breach Risk subscription.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 11
- Broad product review sources
- 1
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingUnresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.
View research methodologyVerified findingsA current 14-day Breach Risk free trial is published; conversion, payment-card, market, and cancellation details are not stated on the plan table.
- Employee-banded monthly Self-service pricing for organizations below 10,000 employees, a published starting annual price period for Standard, and contact-sales Enterprise pricing. Billing frequency does not establish commitment duration; add-ons, bundles, adjacent products, and managed services require separate commercial confirmation.
- Continuous agentless external domain and IP discovery Unlimited domain and IP inventory on all current paid plans WHOIS, DNS, mail, certificate-transparency, redirect, reverse-DNS, and certificate-based attribution Daily passive scans across ports, DNS, TLS, exposed products, and public configurations Verified and version-inferred CVE findings with CVSS, EPSS, and CISA KEV context Security ratings, risk profiles, executive reports, and industry benchmarking Internal remediation requests, recipients, due dates, guidance, waivers, tracking, and rescans Standard and Enterprise Threat Monitoring, typosquatting, API access, and integrations Enterprise audit log, advanced roles, asset portfolios, subsidiaries, and 20 included users
- $250 per month for one current Breach Risk Self-service subscription for an organization with 0 to 99 employees; the source uses a dollar sign but does not name the currency.
- The current help-center table binds three Self-service monthly prices to employee-count eligibility and publishes Standard from $19,999 per year. Currency is retained as not stated because the source names no currency. Enterprise, add-ons, bundles, and adjacent products are quote-based. Annual price presentation is not treated as proof of an annual commitment.
Verification notes and unresolved itemsA broad feature page states that monitoring starts at $5,000 per year, while the current dedicated plan table and billing guide publish Self-service from $250 per month and Standard from $19,999 per year. The detailed current plan states are retained and the older nonspecific amount is excluded.
- Official pages display dollar signs without naming a currency in the retained pricing statements. All four numeric offers are preserved with currency set to not stated.
- Current official pages establish all eight required ASM attributes, the BreachSight-to-Breach Risk naming transition, exact plan gates, three employee-banded Self-service monthly states, a Standard starting annual price period, and a 14-day trial.
- Currency is not inferred from the dollar sign, and annual presentation is not treated as commitment.
- Vendor Risk, Trust Exchange, User Risk, Risk Automations, Managed Vendor Assessments, Managed Data Leaks, Premium Assurance, and third-party destination products remain outside the base target scope.
Sources checked
Sources checked
UpGuard Breach Risk source links
UpGuard TPRM ServicesUpGuard, Inc.Level A2Linked to 1 scored claimChecked Aug 10, 2026
What is the difference between UpGuard Vendor Risk and UpGuard Breach Risk?UpGuard, Inc.Level A2Linked to 1 scored claimChecked Aug 10, 2026
UpGuard IntegrationsUpGuard, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
How to request remediation from someone at your organizationUpGuard, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Security Ratings FAQUpGuard, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
What is the UpGuard Breach Risk vulnerabilities module?UpGuard, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Domain and IP attribution in UpGuardUpGuard, Inc.Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Managing self-service billing in UpGuardUpGuard, Inc.Level A2Linked to 4 scored claimsChecked Aug 10, 2026
FAQ
UpGuard Breach Risk FAQ
Is UpGuard BreachSight still the current product name?
No. UpGuard's current pages call the product Breach Risk. Legacy help URLs still contain BreachSight, so this package keeps the requested upguard-breachsight slug while evaluating current Breach Risk scope.
What does current Breach Risk Self-service cost?
The current monthly states are $250 for 0 to 99 employees, $500 for 100 to 999, and $2,000 for 1,000 to 9,999. Organizations with at least 10,000 employees contact sales. The pages do not name the dollar currency.
Are Threat Monitoring and API access included in Self-service?
No. The current plan table adds Threat Monitoring, two Standard Transforms, typosquatting, and API access at Standard and Enterprise.
Does Breach Risk include Vendor Risk or Trust Exchange?
No automatic inclusion is assumed. Vendor Risk is the separate third-party product, and Trust Exchange is a separate product or paid premium-plan add-on requiring commercial confirmation.
Does Breach Risk validate vulnerabilities and remediation?
It distinguishes some confirmed vulnerabilities from version-inferred findings, supplies CVSS, EPSS, and KEV context, and permits owned-asset rescans. This is external finding and fix verification, not multi-hop attack-path exploitation.
Popular comparisons
Common UpGuard Breach Risk comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.