Security Profile Rating Update: November 2026
Overview
From November 4th 2026, the Security Profile assessment rating will weigh a vendor's risks against how many checks they pass and how much evidence they've provided. Vendors who share more evidence get credit for the checks they pass, not just a deduction for every risk found.
The change applies only to Security Profile risk assessments, and published ones keep the assessment rating they were published with. The vendor's overall security rating, and every other rating and report in Vendor Risk, stay the same.
What's changing
The Security Profile assessment rating combines an automated scan rating and an evidence rating. From November 4th 2026, the way the evidence rating is calculated is changing; the automated scan rating is not changing.
Before November 4th 2026, the evidence rating subtracted a fixed number of points for every evidence risk found, regardless of how large the assessment was and how many checks the vendor passed. On a large control template, a modest number of risks could take the evidence rating to zero. With the new algorithm:
- Risks are weighed against passing checks. The same number of risks counts for less when the vendor passes many checks, and for more when they pass few. Risk severity still counts. Failures on checks that signal weaker security practice count for more, and those weights come from security posture signals we see across vendors.
- Little evidence no longer means a low rating by default. A vendor that has shared a little clean evidence is no longer pulled toward zero. Checks with no evidence still lower the rating.
- The risks themselves don't change. The evidence, and the risks found in it, stay the same. Each risk keeps its severity.
Example
Consider a vendor with 306 evidence checks: 210 pass, 15 are flagged as risks (10 High and five Medium), and 81 have no evidence. Under the previous algorithm, the risks alone took the evidence rating to 0 (F). Under the new algorithm introduced on November 4th 2026, the same vendor's evidence rating is about 582 (C). That still reflects the outstanding risks, but in proportion to the evidence provided.
Which risk assessments are affected
- New risk assessments performed from November 4th 2026 will use the new algorithm.
- Risk assessments in progress on November 4th 2026 will use the new algorithm.
- Published risk assessments keep their original rating, and reports you've already downloaded stay as they are, so your audit record stands.
What you need to do
- Publish in-progress risk assessments before November 4th 2026 if you want them to keep the previous algorithm. Anything still in progress on that date will use the new algorithm.
- Compare like with like. Compare a vendor's ratings only between risk assessments published on the same side of November 4th 2026. A vendor reassessed after that date can show a different rating even if nothing about the vendor has changed.
- Note the change in the assessment. When you publish a risk assessment after November 4th 2026, add a sentence to its executive summary saying the rating uses the updated algorithm. That way, anyone who reads the assessment, such as your stakeholders or auditors, can tell that a change from the vendor’s earlier ratings may come from the algorithm, not from the vendor. To edit the summary, click the pencil icon next to it. See Vendor Risk Security Profile: Assessments.
- Review rating-based acceptance criteria. If you use a Security Profile assessment rating threshold to decide whether to accept a vendor, check that it still fits.
- Explain a higher rating in terms of evidence. If someone asks why a vendor's rating went up, the rating now reflects the vendor's risks in proportion to all the evidence they've provided. The risks you've identified are the same.
🎵 Security Profile is in beta, so its scoring method may change as we refine it. Questions about this update? Contact your Customer Success Manager or support@upguard.com.