TrustSek as an UpGuard alternative
Both rate an organisation's internet-facing security from the outside and both publish how their score is weighted. They differ in the scale, the method and what surrounds the score. This page sets out those differences from public sources.
Last reviewed
UpGuard is a cyber risk posture management platform.
As described on its website on 27 September 2026, UpGuard is “a complete cyber risk posture management platform” for managing cyber risk “across your vendors, attack surface, and workforce”. Its products are Vendor Risk, Breach Risk, User Risk, Trust Exchange and Risk Automations, and its site names security questionnaire templates such as ISO 27001, NIST CSF, DORA and SIG Lite.
UpGuard's security ratings range from 0 to 950, with a letter grade from A (801–950) to F (0–200). Its help centre describes a subtractive algorithm: assets start at 950 and lose points for each failed check, based on severity and weight. Findings fall into ten categories, and the help centre publishes how penalties are distributed across them. It describes “non-invasive, passive data collection” and says data collection and analysis is conducted daily.
TrustSek starts from a baseline and adds risk.
TrustSek scores a domain from the outside in too. You give it a domain; it collects public evidence and returns a score with every finding explained, without agents, integrations or access to your systems.
Where a subtractive score starts high and loses points, TrustSek starts at a baseline and adds risk. The scoring policy assumes a 2% chance that an average organisation has a cyber incident in a year; a domain with no findings sits at 1.0×, and each finding raises the multiplier according to its severity, its confidence and its module's weight. The result falls into one of four bands.
The six modules and their weights:
| Module | Weight | What it looks at |
|---|---|---|
| Email securitySPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. | 20% | SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. |
| TLS and web hygieneWhether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. | 20% | Whether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. |
| Ransomware exposureClaims naming the organisation on ransomware leak sites, from two independent trackers. | 20% | Claims naming the organisation on ransomware leak sites, from two independent trackers. |
| ReputationThe domain and its addresses on threat-intel, malware, phishing and botnet lists. | 15% | The domain and its addresses on threat-intel, malware, phishing and botnet lists. |
| VulnerabilitiesAdvertised software versions matched against known-exploited and published vulnerabilities. | 15% | Advertised software versions matched against known-exploited and published vulnerabilities. |
| Attack surfaceSubdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. | 10% | Subdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. |
Every finding has the same four parts: what was tested, why it matters, the impact and the steps to fix it. A source that failed or was never asked is shown as not checked and adds nothing to the score, so a gap in the evidence never looks like a clean result. The methodology sets out the whole calculation. TrustSek is built for Sweden and the Nordics. The site and the methodology are in Swedish and English; findings in the app are reported in English.
The approaches side by side.
The UpGuard column contains only what its website and help centre stated on 27 September 2026. Where they did not say, we do not guess.
| TrustSek | UpGuard | |
|---|---|---|
| What the score looks like | A multiplier on a 2% annual baseline, in four bands | A number from 0 to 950, with a letter grade from A to F |
| How the score is built | Starts at the baseline; findings add risk by severity, confidence and module weight | Subtractive: assets start at 950 and lose points for failed checks |
| Categories and weights | Six modules with weights fixed per policy version and published on the methodology page | Ten categories, with the distribution of penalties published in their help centre |
| Where the evidence comes from | Public sources, plus one TLS handshake and two web requests to the domain; non-intrusive, no port scans | “Non-invasive, passive data collection” |
| How often it updates | When you run a scan, in about 30 seconds; no monitoring between scans | Data collection and analysis conducted daily |
| Around the score | Supplier tracking, portfolio views, PDF reports, a REST API | Vendor risk, attack surface, workforce risk, questionnaires, trust pages, risk automations |
| Framework mapping | Findings mapped to NIS2, ISO/IEC 27001:2022, CIS Controls v8 and SOC 2 | Questionnaire templates including ISO 27001, NIST CSF, DORA and SIG Lite |
| Language and market | Built for Sweden and the Nordics; site and methodology in Swedish and English, findings in English | Not stated in the sources cited |
When TrustSek may fit.
- You want to read a score as a multiple of a stated baseline, with every finding's reason and fix in the same place.
- You want gaps in the evidence shown as not checked, next to the number.
- You work in Sweden or the Nordics and want the method explained in Swedish as well as English.
- You need findings mapped to NIS2, ISO 27001, CIS Controls or SOC 2 controls from outside-in evidence.
When UpGuard may fit better.
- You need continuous monitoring of vendors, with data collected daily. TrustSek is a scan you run; it does not watch domains between scans or send alerts.
- You want security questionnaires, questionnaire templates and a trust page in the same platform as the rating.
- You also want to manage workforce risk, such as the use of AI tools by staff.
- You prefer a 0 to 950 score with an A to F letter grade.
About this comparison
UpGuard is a trademark of its owner, and TrustSek is not affiliated with UpGuard. Everything said about UpGuard here comes from the public pages listed as sources, as they read on 27 September 2026. We make no claim about its accuracy, prices, customers or quality. If something is out of date, tell us at sales@trustsek.com and we will correct it. Other comparisons are on the compare page.
See how your domain scores
Free, from public evidence. Every finding comes with the reason and the fix.