Start from a neutral baseline and add what matters to you. Criteria are labeled by source — the platform baseline is architecture-neutral; buyer-contributed criteria are shown separately.
Build your evaluation
no account needed
Match on your requirements
no account needed
This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.
1. Weight what matters
22 criteria
baselineWhat SBOM capabilities does the product provide — generation (SPDX/CycloneDX), ingestion of third-party SBOMs, and continuous reconciliation against what's actually deployed?
baselineDescribe malicious-package detection (typosquatting, dependency confusion, hijacked maintainer accounts, install-script malware) — what is the detection methodology, and what is the measured time from a malicious package appearing in a registry to your feed flagging it?
baselineHow does the product prioritize vulnerable dependencies — does it distinguish reachable/exploitable vulnerabilities (called from your code) from vulnerable-but-unreachable ones, and what is the typical noise reduction from reachability analysis?
baselineWhat build-pipeline integrity features are supported — provenance attestation (SLSA levels, in-toto), signed builds, and verification that what's deployed matches what was built?
baselineDetail secrets-in-code detection across the SDLC (pre-commit, CI, retroactive history scans) and the remediation workflow when a live credential is found in a public or internal repo.
baselineHow does the product handle license compliance — detection of copyleft/incompatible licenses in dependencies, policy enforcement in CI, and legal-report generation?
baselineExplain container/image supply-chain coverage — base-image vulnerability tracking, image signing/verification (Sigstore/cosign), and registry-level admission control blocking unsigned or policy-violating images.
baselineWhat developer-experience guardrails exist to keep this from becoming a blocker — PR-level feedback with fix suggestions, auto-remediation PRs for dependency upgrades, and measured false-positive rates?
baselineWhat is the pricing model — per developer, per repository, or per build — and how does cost scale as the organization's dependency count and build volume both grow significantly?
baselineDescribe incident-response capability for a confirmed supply-chain compromise already deployed to production (e.g., a malicious package discovered after it shipped) — can the platform quickly identify every affected build/deployment across the environment, and what is a customer-referenced turnaround time?
baselineDoes the platform map coverage to named supply-chain-security frameworks (Executive Order 14028, NIST SSDF, SLSA levels) with audit-ready reporting, and at what SLSA level does the platform's own recommended pipeline configuration achieve?
baselineDetail historical trend reporting on supply-chain risk posture (vulnerable-dependency count, unsigned-build count, secrets-found count) over time, suitable for demonstrating program maturity progress to leadership.
baselineHow does the platform integrate with (versus duplicate) the customer's existing vulnerability management and ASPM tooling — does supply-chain risk feed into the same unified risk view, or is it a separate, disconnected dashboard?
baselineWhat is the breadth of language/ecosystem coverage (npm, PyPI, Maven, Go modules, Rust crates, NuGet, etc.), and is coverage depth uniform across all of them, or meaningfully shallower for less-common ecosystems the vendor should disclose honestly?
baselineWhat is the measured false-positive rate specifically on malicious-package detection (flagging a legitimate package as malicious), and what is the remediation/appeal process if a legitimate package/release is incorrectly blocked, given the business-disruption risk of a false block?
baselineDoes the platform support air-gapped or private-registry environments common in regulated/government customers, where dependencies can't be resolved against public registries for real-time reputation/malware checks?
baselineComplete the North American Transmission Forum (NATF) Vendor Questionnaire, addressing NATF's cybersecurity supply-chain criteria for suppliers.
baselineAny proposal must be compliant with FCC Order 19-121, which prohibits the sale, provision, maintenance, modification, or other support of equipment or services from Huawei, ZTE, or any other covered company (including Kaspersky Lab) posing a national-security threat to communications networks or the supply chain; by submitting a response, vendors certify compliance.
baselineContractor shall support Supply Chain Risk Management (SCRM) activities, including coordination, record maintenance, and risk mitigation recommendations for third-party technologies, and support AI security-related compliance, vulnerability, and risk activities for systems/tools that incorporate AI-enabled functions or emerging technologies.
baselineComplete the Supply Chain information (TVE Sheet 5), disclosing the vendor's supply chain for evaluation.
baselineContractor shall be responsible for establishing and managing a Supply Chain Risk Management (SCRM) Program per NDAA FY2019, Executive Order 14028, and applicable federal agency guidance, including developing an SCRM program charter and plan, operating and enhancing SCRM with vendor risk intelligence and continuous monitoring integrated with IT Architecture/Standards, Procurement, and OGC, and developing OKRs demonstrating SCRM program success.
baselineIs it possible for any third party (your service providers) to access data, and if so, how?
Signing up adds sharing with your team, sending this as an RFP to vendors, and private document sharing. Nothing above is taken away, and nothing here is sent anywhere until you choose to.
Platform baseline
neutral · staff-reviewed
RFIWhat SBOM capabilities does the product provide — generation (SPDX/CycloneDX), ingestion of third-party SBOMs, and continuous reconciliation against what's actually deployed?Answer key — what a strong answer shows
Look for both standard formats and — the harder part — reconciliation of SBOMs against deployed reality; a point-in-time SBOM that drifts from production is compliance theater.
RFPDescribe malicious-package detection (typosquatting, dependency confusion, hijacked maintainer accounts, install-script malware) — what is the detection methodology, and what is the measured time from a malicious package appearing in a registry to your feed flagging it?Answer key — what a strong answer shows
Strong answers name the behavioral/heuristic methodology and give a real time-to-flag figure — signature-only or CVE-only approaches miss the malicious-package class entirely (these aren't 'vulnerabilities').
RFIHow does the product prioritize vulnerable dependencies — does it distinguish reachable/exploitable vulnerabilities (called from your code) from vulnerable-but-unreachable ones, and what is the typical noise reduction from reachability analysis?Answer key — what a strong answer shows
Reachability analysis is the difference between thousands of alerts and dozens; look for a stated methodology (call-graph analysis) and a real noise-reduction figure.
RFIWhat build-pipeline integrity features are supported — provenance attestation (SLSA levels, in-toto), signed builds, and verification that what's deployed matches what was built?Answer key — what a strong answer shows
Look for concrete SLSA-level claims with attestation artifacts, not just 'we secure your pipeline' — provenance is verifiable or it's nothing.
RFPDetail secrets-in-code detection across the SDLC (pre-commit, CI, retroactive history scans) and the remediation workflow when a live credential is found in a public or internal repo.
From other buyers
crowdsourced · anonymized
💬
No buyer-contributed criteria yet
Verified buyers can suggest criteria (anonymized before pooling).
Answer key — what a strong answer shows
Strong answers cover all three scan points plus an actual remediation workflow (auto-revocation integration, not just an alert) and validity-checking to separate live credentials from dead ones.
RFIHow does the product handle license compliance — detection of copyleft/incompatible licenses in dependencies, policy enforcement in CI, and legal-report generation?Answer key — what a strong answer shows
License risk is part of supply-chain risk; look for policy-as-code enforcement in CI with legal-consumable reporting, not just a license inventory list.
RFPExplain container/image supply-chain coverage — base-image vulnerability tracking, image signing/verification (Sigstore/cosign), and registry-level admission control blocking unsigned or policy-violating images.Answer key — what a strong answer shows
Look for the full chain: signed images, verification at admission, and base-image update automation — scanning alone without admission control doesn't prevent anything.
RFIWhat developer-experience guardrails exist to keep this from becoming a blocker — PR-level feedback with fix suggestions, auto-remediation PRs for dependency upgrades, and measured false-positive rates?Answer key — what a strong answer shows
Supply-chain tools fail by being ignored; look for in-PR feedback, automated upgrade PRs, and an honest false-positive figure — developer adoption is the real success metric.
RFIWhat is the pricing model — per developer, per repository, or per build — and how does cost scale as the organization's dependency count and build volume both grow significantly?Answer key — what a strong answer shows
Look for transparent, predictable scaling economics; a vendor unable to project cost at meaningfully higher scale creates real budget risk for a growing engineering organization.
RFPDescribe incident-response capability for a confirmed supply-chain compromise already deployed to production (e.g., a malicious package discovered after it shipped) — can the platform quickly identify every affected build/deployment across the environment, and what is a customer-referenced turnaround time?Answer key — what a strong answer shows
Strong answers describe a fast, comprehensive blast-radius query capability with a real turnaround-time figure — this is the highest-stakes use case (an actual live compromise), not just preventive scanning.
RFIDoes the platform map coverage to named supply-chain-security frameworks (Executive Order 14028, NIST SSDF, SLSA levels) with audit-ready reporting, and at what SLSA level does the platform's own recommended pipeline configuration achieve?Answer key — what a strong answer shows
Look for explicit, named framework/level mapping rather than a vague 'follows best practices' claim — SLSA levels specifically are a concrete, checkable claim.
RFPDetail historical trend reporting on supply-chain risk posture (vulnerable-dependency count, unsigned-build count, secrets-found count) over time, suitable for demonstrating program maturity progress to leadership.Answer key — what a strong answer shows
Trend-over-time reporting is a distinct capability from a real-time dashboard — confirm this exists as a maintained, exportable report.
RFIHow does the platform integrate with (versus duplicate) the customer's existing vulnerability management and ASPM tooling — does supply-chain risk feed into the same unified risk view, or is it a separate, disconnected dashboard?Answer key — what a strong answer shows
Look for genuine integration into a unified risk view; a standalone supply-chain dashboard disconnected from the broader AppSec/VM picture creates real reconciliation burden.
RFIWhat is the breadth of language/ecosystem coverage (npm, PyPI, Maven, Go modules, Rust crates, NuGet, etc.), and is coverage depth uniform across all of them, or meaningfully shallower for less-common ecosystems the vendor should disclose honestly?Answer key — what a strong answer shows
Ask for an honest per-ecosystem coverage breakdown; a vendor with uneven ecosystem coverage should disclose which languages get shallower treatment rather than implying uniform depth across everything.
RFPWhat is the measured false-positive rate specifically on malicious-package detection (flagging a legitimate package as malicious), and what is the remediation/appeal process if a legitimate package/release is incorrectly blocked, given the business-disruption risk of a false block?Answer key — what a strong answer shows
A false positive on malicious-package detection can break a production build or block a legitimate release — ask for a real accuracy figure and a fast appeal/override process, not just a detection-rate claim.
RFIDoes the platform support air-gapped or private-registry environments common in regulated/government customers, where dependencies can't be resolved against public registries for real-time reputation/malware checks?Answer key — what a strong answer shows
Look for a genuine offline/private-registry operating mode; a platform requiring live internet access to public registries for every scan has a real deployment gap for regulated air-gapped environments.
RFPComplete the North American Transmission Forum (NATF) Vendor Questionnaire, addressing NATF's cybersecurity supply-chain criteria for suppliers.
RFPAny proposal must be compliant with FCC Order 19-121, which prohibits the sale, provision, maintenance, modification, or other support of equipment or services from Huawei, ZTE, or any other covered company (including Kaspersky Lab) posing a national-security threat to communications networks or the supply chain; by submitting a response, vendors certify compliance.
RFPContractor shall support Supply Chain Risk Management (SCRM) activities, including coordination, record maintenance, and risk mitigation recommendations for third-party technologies, and support AI security-related compliance, vulnerability, and risk activities for systems/tools that incorporate AI-enabled functions or emerging technologies.
RFPComplete the Supply Chain information (TVE Sheet 5), disclosing the vendor's supply chain for evaluation.
RFPContractor shall be responsible for establishing and managing a Supply Chain Risk Management (SCRM) Program per NDAA FY2019, Executive Order 14028, and applicable federal agency guidance, including developing an SCRM program charter and plan, operating and enhancing SCRM with vendor risk intelligence and continuous monitoring integrated with IT Architecture/Standards, Procurement, and OGC, and developing OKRs demonstrating SCRM program success.
RFPIs it possible for any third party (your service providers) to access data, and if so, how?
