← UpGuard
UpGuard role-play cheat sheet
For the mock cold call at the end of most SDR interviews.
What they sell, in one line
Software that shows companies where their vendors, public-facing systems, and employees could let hackers in.
Who you'd be calling
CISOs, heads of security, GRC and vendor risk managers at mid-size to large companies, especially in finance, tech and healthcare.
Your opener
“Hi [Name], this is [Your Name] from UpGuard. I know I'm calling out of the blue. Can I take 30 seconds to say why I called, and you can tell me if it's worth your time?”
Problems you solve for them
- Hundreds of vendors, and no way to know which ones are risky
- Security questionnaires take weeks and go stale fast
- Unknown internet-facing systems and leaked data nobody is watching
- Auditors and customers ask for proof of vendor oversight
Discovery questions to ask
- How do you check today whether a new vendor is safe to work with?
- How many vendors have access to your data or systems, and who keeps track of them?
- What happens when a customer or auditor asks you to prove your vendor risk process?
Objections they'll throw at you
“I'm really busy right now.”
→ Totally get it, I'll be quick. Would it be better if I called back at a time that works, say Thursday morning?
“We're not interested.”
→ Fair enough. Most security leads I call say that until they see how many vendor risks they can't currently see. Can I ask how you track vendor risk today?
“We already use something for this.”
→ Good, so vendor risk is already a priority for you. What do you like about it, and is there anything you wish it did better?
“Just send me an email.”
→ Happy to. So I send you something useful, what's the biggest vendor or exposure worry on your plate right now?
Competitors worth knowing
SecurityScorecard, BitSight, OneTrust, Panorays
Interview tips for this company
- Learn the three pieces: vendor risk, attack surface, and workforce risk, and be able to explain each in one plain sentence.
- Practice saying 'third-party risk' simply: the risk that comes from the companies you work with, not your own systems.
Written from public information about UpGuard to help you practice. Ask an insider what their role play looked like; it's the best prep there is.