New
Which security investments are you prioritising for FY27?
Identity, cloud security posture, AI security, SOC automation, resilience? Share your top two and why.
Evaluation guide
How to evaluate security vendors
This guide is for security leaders, architects and engineering managers who are replacing a tool, consolidating several, or adding a control after an audit finding or an incident. It assumes you know the acronyms and want a way to compare vendors that will hold up in front of a risk committee.
In short
Use this guide to build a security shortlist you can defend. Judge vendors on detection quality in your own environment, identity coverage, how well they fit the tools you already run, the real cost of operating them and how they behave when something goes wrong. Then compare three to five companies on Techarda using recent news, practitioner questions and reviews.
What’s changing in Security
Before you compare anyone, it helps to know what has shifted in the market, because it changes which questions matter.
Platforms are absorbing point products
The larger vendors now bundle endpoint, identity, cloud and network controls under one console and one contract, and price the bundle to make switching look cheap. The question has shifted from "which tool is best" to "how much should one supplier own".
Identity is the main way in
More incidents start with stolen credentials, hijacked sessions or loose SaaS permissions than with malware on a laptop. Identity threat detection and SaaS posture have moved from nice to have into the core of most programmes.
AI assistants have arrived in the SOC
Most vendors now offer an assistant for triage, investigation and query writing. The good ones take real time off routine alerts. Weaker ones restate what the console already showed you, so test them on your own cases.
Evidence matters as much as detection
Disclosure rules, critical infrastructure obligations (in Australia, the SOCI Act and ransomware payment reporting) and board accountability mean you need to show what happened and what you did about it, quickly and in plain language.
What to judge vendors on
Those shifts shape the criteria below. Each one says why it matters and what to ask, so you can take it straight into a vendor call.
| Criterion | Why it matters | What to ask vendors |
|---|---|---|
| 1Detection quality in your environment | Lab results and vendor-run demos rarely match your mix of operating systems, cloud accounts and older systems. Every false positive costs analyst time, every day. | “Can we run a proof of value on our own endpoints and logs for several weeks, and will you share the true and false positive results from that run?” |
| 2Identity and SaaS coverage | If attackers log in rather than break in, a control that only watches devices will miss the start of most incidents. | “Which identity providers and SaaS apps do you monitor natively, and what do you detect when a session token is reused from a new device or location?” |
| 3Fit with your existing stack and data portability | Your SIEM, ticketing and response tooling still need the data. Proprietary formats and export fees make it expensive to change your mind later. | “Can we export raw telemetry and detections in an open schema to our own storage, and what does that cost at our volumes?” |
| 4Response and containment | Detection without fast, safe response leaves your team watching an incident unfold. Automated actions also need to be reversible. | “Which response actions can run automatically, how are they rolled back, and who approves them out of hours?” |
| 5Update safety and vendor resilience | Security agents run with deep privileges. A bad update or a breach at the vendor becomes your incident. | “How do you stage content and agent updates, can we control rollout rings, and how do you tell customers about incidents in your own infrastructure?” |
| 6True operating cost | The licence is only part of it. Tuning, agent upgrades, log ingestion, retention and managed service tiers often cost more over three years. | “What does a team of our size need to run this well, and how do ingestion and retention charges change as our data grows?” |
| 7Data handling and residency | Telemetry contains user names, file paths and sometimes content. Where it lives and who can see it are privacy and sovereignty questions as well as technical ones. | “Where is our telemetry stored and processed, which of your staff can access it, and can we set retention by data type?” |
| 8Reporting for auditors and the board | You will be assessed against frameworks such as the Essential Eight or ISO 27001. If the evidence takes days to assemble, it will be out of date when you present it. | “Which reports map your controls to the frameworks we are assessed against, and can we produce them ourselves without professional services?” |
Trade-offs to settle early
No vendor does well on every criterion, and some pull against each other. Decide where you stand on these before the demos start, or the demos will decide for you.
Platform consolidation or best of breed
One supplier means fewer consoles, one contract and shared context across signals. Specialists often go deeper in their area and move faster. Most teams end up with a platform plus two or three specialists; the real decision is where you draw that line.
Managed service or in-house operation
A managed detection service gives you round-the-clock cover you may not be able to staff. You give up some control over tuning and response decisions, and your team learns less about its own environment.
Agent depth or agentless breadth
Agents see more and can act, but they add deployment work and another thing that can break. Agentless tools cover more ground quickly, especially in cloud, but see less and usually cannot contain.
Automated response or change control
Automatic isolation stops an attack faster. It can also take down a production system at 2 am. Decide in advance which assets can be contained without a human.
One accountable supplier or concentration risk
Consolidating gives you one supplier to hold accountable. It also means one vendor outage or breach touches every control you run at once.
Red flags
As the answers come back, watch for these. One on its own isn’t a deal breaker, but it deserves a follow-up question in writing.
- The vendor will not run a proof of value on your data, or insists on running it without your team watching.
- Detection claims rest only on tests the vendor commissioned or designed.
- Pricing jumps at renewal or scales with ingestion volume without a cap.
- No clear, specific answer about how updates are staged and rolled back.
- Raw data export is locked behind a higher tier or a separate product.
- References come only from organisations much larger or much smaller than yours.
Build your shortlist
Start with the problem, then use Techarda to narrow the field to three to five companies you can compare fairly.
- Write down the one or two controls you are buying and the systems they must cover. Set aside companies whose main focus does not match.
- Include at most one broad platform vendor and at least one specialist, so you can test the consolidation trade-off directly.
- Read each company’s recent stories on Techarda for outages, acquisitions and product retirements, and note what you need to ask about.
- Check the open practitioner questions below. If yours is missing, ask it.
- Compare the shortlist side by side, then run proofs of value with no more than three.
Companies to consider in Security
Listed by recent activity on Techarda (what people are reading, following and discussing). The order says nothing about quality, market share or fit for your needs.
Latest Security stories
Once you have names, recent news is where pricing changes, acquisitions and outages show up first. These are the five newest stories in this category.
Security
September 2026 Cyber Threat Landscape: Global Attacks Jump 48% as Phishing and GenAI Data Exposure Rise
Key takeaways Organizations experienced 2,803 weekly cyber attacks on average in September, up 16% month over month and 48% year over year. Education remained the most targeted sector, averaging 6,656 weekly attacks per organization, a 59% year-over-year increase. Europe recorded the sharpest regional rise at 61% year over year, while Latin America faced the highest volume at 3,813 weekly attacks…
Security
Bridging technical depth and usability: The story behind Radar’s redesign
We redesigned Cloudflare Radar to make real-time global traffic and outage data accessible to a wider audience, including journalists, less technical researchers, and everyday users. By introducing an interactive map and standardized components, we simplified navigation while preserving technical depth.
SecurityCase study
Inside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents
Community-built AI agents, skills, and MCP servers are landing in SOC workflows fast. Here’s what the Exchange Inspector tests before a listing earns its vetted tag on the CyberAgents Exchange. Three tools have already passed. Key takeaways Every Inspector-vetted listing clears three gates: an automated check, a frontier model assessment, and human verification. Tenable uses Tenable One AI…
Security
Solving the Continuous Authorization Conundrum
Security
The real risk of asking AI for financial advice isn’t ignorance. It’s compliance.
TrendLife tested on multiple AI assistants to see how they work when giving financial advice. See what we find out & risks to watch out for: The post The real risk of asking AI for financial advice isn’t ignorance. It’s compliance. appeared first on TrendLife Blog .
What practitioners are asking
News tells you what vendors announced. These open questions show what teams are still trying to work out, with the least-answered first.
New
What does your ransomware recovery plan look like after the last round of tests?
Immutable backups, isolated recovery environments, recovery-time testing. What did your last exercise reveal?
New
How are you approaching AI governance and model risk management?
Inventories, risk tiers, approval workflows, monitoring. What framework did you adopt and what does day-to-day governance look like?
New
Which skills are you hiring for in FY27 that you were not a year ago?
AI engineering, platform, FinOps, security automation? Share what is on your hiring plan.
New
How far along is your zero-trust journey, honestly?
Identity-first access, device posture, microsegmentation: which parts are done and which keep slipping?
New
What is your approach to managing thousands of edge devices?
Fleet management, updates, security patching and observability at the edge: what tools and practices have held up?
Where evidence is thin
A shortlist is only as good as the evidence behind it, and ours is still growing category by category. Here is what’s missing in Security right now.
20 of 20 companies have no published reviews
If you’ve run one of these in production, a short review helps the next team decide. Reviews are moderated before they appear.
7 questions with no answers yet
An answer from someone who has made the same decision is often more useful than any guide. Share what worked, what didn’t and what you’d check next time.
Answer a Security questionFrequently asked questions
What should I ask Security vendors about detection quality in your environment?
Lab results and vendor-run demos rarely match your mix of operating systems, cloud accounts and older systems. Every false positive costs analyst time, every day. Ask: Can we run a proof of value on our own endpoints and logs for several weeks, and will you share the true and false positive results from that run?
What should I ask Security vendors about fit with your existing stack and data portability?
Your SIEM, ticketing and response tooling still need the data. Proprietary formats and export fees make it expensive to change your mind later. Ask: Can we export raw telemetry and detections in an open schema to our own storage, and what does that cost at our volumes?
What should I ask Security vendors about update safety and vendor resilience?
Security agents run with deep privileges. A bad update or a breach at the vendor becomes your incident. Ask: How do you stage content and agent updates, can we control rollout rings, and how do you tell customers about incidents in your own infrastructure?
What should I ask Security vendors about true operating cost?
The licence is only part of it. Tuning, agent upgrades, log ingestion, retention and managed service tiers often cost more over three years. Ask: What does a team of our size need to run this well, and how do ingestion and retention charges change as our data grows?
This guide is written by Techarda editors. No vendor paid to appear in it or saw it before publication. See our methodology, the trust dashboard or go back to the Security hub.