UpGuard collects data to assess the security posture of millions of organizations every day. We use threat signals gathered from trusted commercial, open-source, and proprietary sources, alongside risks identified in security questionnaires and risk assessments conducted on the UpGuard platform.

These threat signals are open and accessible from the public Internet, which means we only use non-intrusive techniques to gather information. We will never attempt to bypass any security controls an organization has in place.

UpGuard's scanners auto-detect risks on your public facing assets, and the detected risks are listed in your Risk Profile. To view the details of a risk, you can click on a risk and see the details of the risk, the Expected finding and the Actual finding for the risk.

To understand the details of the risk within your own organization's environment, review your domain or IP setup to verify if the settings are as per the Expected value listed against the risk.

From here, you can choose to create a Risk Waiver for the risk or remediate the risk to remove the risk from your organization's attack surface.

If you have compensating controls in place that you deem to be sufficient, the recommended action would be to apply a Risk Waiver or a Public Risk Waiver and add a summary about why this risk is not applicable to your organization.

If you still have questions about a detected risk, believe the finding is a "False-positive", or is otherwise inaccurate, our Support Team is equipped to investigate and replicate findings, and work with you on identifying and remediating these risks where applicable.