How we compare vendors
Each comparison page counts the areas where one vendor leads the other, using public data and a written rule for every area. There is no overall score and no weighting. This page lists the rules exactly as the code applies them.
What we claim, and what we do not
- We say “leads on”, “ahead on” or “even”. We do not call a vendor better, worse, safest or best.
- An area counts only when both vendors have recent data for it. Missing or out-of-date data is shown as “Not enough data” and is never counted as a loss.
- A headline such as “leads on 4 of 8 measured areas” appears only when at least 6 areas have data on both sides. Below that, the page says there is not enough public data for a scorecard.
- Raw vulnerability counts are shown for context and never scored on their own: more CVEs often means a bigger, more closely examined product with better disclosure.
- There is no composite “overall winner” and no weighted total, because a weighting would be our opinion presented as data.
- A tie margin is published for every area. A difference smaller than the margin is “even”.
- Every number carries its source and the date it was checked. A fact older than its freshness budget is left out.
- Third-party ratings are shown with their source and review count, and are never marked up as our own review rating.
- We have no win/loss data from buyers’ decisions, so we make no claim about how often one vendor is chosen over another.
- Paid listings never change which pairs exist, their order, or their wording.
- If a fact looks wrong, use “Flag a wrong fact” on the comparison page. A person reviews every flag.
Measured areas
| Area | What it measures | Rule for a lead | Fresh within | Sources |
|---|---|---|---|---|
| Capability coverage (shared layers)Scored | Documented capabilities in shared layers | Counts the capabilities each vendor is documented as including, only in capability layers where both vendors have products. One leads when it has at least 10% more and at least 2 more.Margin: at least 2 capabilities more and at least 10% more. | 180 days | 0-Doubt capability map (vendor documentation and evidence quotes) |
| Public security hygieneScored | Points out of 9 | Scores 0 to 9 from what can be observed from outside: security headers (0 to 5), a security.txt file, DNSSEC, CAA records and HSTS preload, one point each. One leads when it has at least 2 points more.Margin: at least 2 points more. | 30 days | Homepage response headers; RFC 9116 security.txt; DNS (DNSSEC, CAA); hstspreload.org |
| Trust and compliance evidenceScored | Points | Counts certification families found for the vendor (SOC 2, ISO 27001, ISO 27017/27018, FedRAMP, PCI DSS, CSA STAR, HIPAA attestation): 2 points when confirmed in a public registry, 1 when only stated or detected, plus 1 for a trust center. One leads when it has at least 2 points more.Margin: at least 2 points more. | 90 days | Public certification registries; Vendor trust pages |
| Vulnerability disclosure maturityScored | Points out of 2 | One point for a bug bounty or vulnerability disclosure policy and one for a security.txt file. One leads when it has at least 1 point more.Margin: at least 1 points more. | 90 days | Vendor security pages; Bug bounty platforms; RFC 9116 security.txt |
| Exploited vulnerabilities, last 24 monthsContext, not scored | KEV-listed CVEs | Counts the vendor's matched CVEs added to CISA's Known Exploited Vulnerabilities catalog in the last 24 months. Shown for context and not counted in the scorecard: CVEs are matched to vendors by name, not by product identifier, so the count can include another company's product. | 7 days | CISA Known Exploited Vulnerabilities catalog; NVD |
| Pricing transparencyScored | Points out of 2 | One point for a public pricing page and one for a starting price shown. One leads when it has more.Margin: at least 1 points more. | 90 days | Vendor pricing pages |
| Service transparencyScored | Points out of 1 | One point for a public status page. One leads when it has more.Margin: at least 1 points more. | 30 days | Vendor status pages |
| Third-party user ratingScored | Rating out of 5 | The PeerSpot rating on a 5-point scale, only when both vendors have at least 10 reviews there. One leads when it is at least 0.2 higher.Margin: at least 0.2 out of 5 more. | 180 days | PeerSpot |
| Integration ecosystemScored | Catalog integrations | Counts integrations the vendor lists with other vendors in the catalog. One leads when it has at least 25% more and at least 5 more.Margin: at least 5 integrations more and at least 25% more. | 180 days | Vendor integration pages |
Peer percentiles
Where a page says a vendor is “ahead of 82% of 140 vendors”, that is the share of the other vendors in the same category with data on that area whom it leads by the area’s margin. A percentile is published only when at least 20 other vendors in the category have data.
Capability overlap
The overlap lists capabilities documented for each vendor, in capability layers where both have products. “Only {vendor}” means we found no public evidence for the other vendor, which is not the same as the capability being missing.
Feature tables
Where both vendors have products in a category, the comparison page shows a feature table for it: one row per capability in the category’s capability layers, one column per product (up to three per vendor, the ones with the most known capabilities first). Each cell is a Harvey ball.
- Full ball: a source says the product includes the capability.
- Half ball: available as an add-on or in a higher edition. The edition is shown when we know it.
- Empty ball: a source says the product does not have it.
- Question mark: unknown. We found no public information, or only an unclear statement. Unknown is never counted as absent, and it is left out of every ratio below.
Every known cell opens to its evidence quote, source link and check date. A fact extracted automatically and not yet checked by a person is marked “unverified”. When sources for one product disagree, the cell shows the one with the strongest provenance, then the most recent.
The ball in a header shows completeness: (capabilities included + half of the add-ons) divided by the capabilities with a known answer, rounded to the nearest quarter (0, 25, 50, 75 or 100%). It always appears with “K of M known”, so a ball built on little data is visible as such. A vendor’s ball takes, for each capability, the best answer across its products in the category. The coverage line under it counts capabilities included by at least one product and uses the same margin as the capability coverage area above: a vendor is said to list more only when it has at least 10% and at least 2 more.
A feature-table page is offered to search engines only when its comparison is, both vendors have a product in the category, and at least 10 capabilities are known for each. Otherwise it stays reachable but is marked noindex.