There's something fittingly contrarian about building a cybersecurity powerhouse in Tasmania—about as far from Silicon Valley's venture capital machine as geography allows. But UpGuard, the Hobart-based firm that first made headlines by exposing data leaks at Facebook and Tesla, has spent thirteen years proving that distance matters less than timing. And right now, the timing couldn't be better.
The company announced a $75 million Series C round on February 26, led by New York growth equity firm Springcoast Partners. The deal (reported as A$105 million in Australian coverage) brings UpGuard's total funding to roughly $120 million. More importantly, it arrives just as the threats the company has been tracking for years are accelerating in ways that have boardrooms genuinely nervous.
Supply chain attacks doubled worldwide in 2025, according to analysis from Cipher and Prosegur. Nearly a quarter of all breaches now involve third parties—the vendors, contractors, and service providers that most companies trust implicitly but scrutinize rarely. Meanwhile, attackers have gotten faster: CrowdStrike's latest threat report found that average "breakout times"—the window between initial compromise and lateral movement across networks—hit just 29 minutes last year. That's 65 percent faster than 2024. AI, it turns out, doesn't just write code and answer emails.
"This round adds more fuel to deliver enterprise-grade solutions for the mid-market," CEO Mike Baukes said in a statement, "and help CISOs and lean teams address complex threats." It's the kind of quote executives always give. What makes it land differently this time is the regulatory backdrop.
When Compliance Catches Up to Chaos
The European Union's Digital Operational Resilience Act went into force in January 2025, imposing strict requirements on financial institutions to manage ICT risks and vet third-party dependencies. Across the Atlantic, the SEC's new cybersecurity disclosure rules now mandate timely incident reporting and annual risk management disclosures—with explicit attention to exactly the kind of supply chain exposures UpGuard has built its business around monitoring.
Which is to say: companies that might once have viewed vendor risk management as a compliance checkbox are starting to treat it as an existential necessity.
UpGuard has spent the past year repositioning around what it calls Cyber Risk Posture Management, or CRPM—a term that's either a genuine category or clever branding, depending on whom you ask. The platform attempts to unify vendor risk, breach monitoring, user risk, trust exchanges (the dreaded security questionnaires), and risk automation into a single interface. The company claims it processes more than 100 billion risk signals daily across 2,000-plus customers and 50,000 organizations in over 90 countries.
The AI numbers are impressive, if almost comically large: 23 billion tokens processed, 70,000 AI risk assessments, and 700,000 AI-autofilled questionnaires in the last 100 days alone. UpGuard's AI Threat Analyst tool, the company says, triaged 90 percent of more than 483,000 breach signals in that same window. Whether that represents genuine efficiency or just aggressive filtering remains an open question—one any CISO evaluating the platform will need to answer for themselves.
Capital, Consolidation, and What Comes Next
The fresh capital will fund the usual priorities: expanding the AI-powered platform, scaling global sales, and pursuing strategic M&A. UpGuard didn't name specific acquisition targets, but the company has been steadily building out modules—launching User Risk (human risk management) to general availability last November and introducing Questionnaire AI autofill in October 2024.
Holger Staude, co-founder of Springcoast Partners, pointed to UpGuard's "proven ability to execute and achieve significant scale and capital efficiency" as the rationale for leading the round. Springcoast, founded just two years ago, closed its inaugural funds in late 2024 with $750 million in capital commitments and more than $1.5 billion in assets under management. For a firm that young to lead a growth round this size suggests confidence—or at least conviction—that the third-party risk management category has room to run.
Existing investors August Capital, Square Peg Capital, and Pelion Venture Partners all participated. Bank of America Securities served as exclusive placement agent, with Fenwick providing legal counsel.
The Long Road From ScriptRock
UpGuard's origin story has the feel of controlled reinvention. Founded in 2012 as ScriptRock and rebranded in 2016, the company first gained attention through breach research—the kind of work that generates headlines but doesn't always translate into revenue. Exposed data at the Republican National Committee, GoDaddy, and others made UpGuard's name. Monetizing that reputation into a sustainable platform business took longer.
The company sold its legacy IT monitoring product (UpGuard Core) to Cloudhouse in December 2020, a strategic retreat that let it focus entirely on security. Square Peg Capital, which first backed the founders in 2012 when they were part of the Startmate accelerator cohort, has remained invested across every subsequent round. That kind of investor continuity is rare, particularly for a company that's pivoted more than once.
The funding timeline tells the story: a roughly $8.7 million Series A in 2014, a $17 million Series B in 2016, a $19 million Series B-1 in 2021 with IAG Firemark Ventures joining, and now this $75 million round. It's not hypergrowth velocity, exactly. But it's steady, disciplined capital deployment in a market that's only recently begun to treat third-party risk as a first-tier concern.
Where the Puck Is Going
UpGuard maintains dual headquarters in Hobart and Mountain View, with employees distributed across 14 countries. The company claims 14 consecutive quarters of G2 category leadership in third-party and supplier risk management and was named to G2's 2026 Best Software Awards—top 15 in Security, top 100 Global Software Companies. LinkedIn pegs headcount in the 201–500 range, though UpGuard didn't disclose exact numbers.
Valuation wasn't disclosed either, nor were immediate M&A plans. But $75 million is serious capital for a company of this scale, and it suggests ambitions beyond incremental feature releases. Perhaps the more interesting question isn't what UpGuard plans to build next—it's what it might buy. In a fragmenting cybersecurity market where point solutions proliferate and buyers crave consolidation, the CRPM platform play could absorb a lot of smaller capabilities.
Or maybe UpGuard just keeps doing what it's done for years: watching the threats everyone else misses, reporting what it finds, and building tools for the people trying to keep up. Either way, the Hobart-to-Mountain-View arc is starting to look less contrarian and more prescient.
