New
What does your ransomware recovery plan look like after the last round of tests?
Immutable backups, isolated recovery environments, recovery-time testing. What did your last exercise reveal?
Evaluation guide
How to evaluate security vendors
This guide is for security leaders, architects and engineering managers who are replacing a tool, consolidating several, or adding a control after an audit finding or an incident. It assumes you know the acronyms and want a way to compare vendors that will hold up in front of a risk committee.
In short
Use this guide to build a security shortlist you can defend. Judge vendors on detection quality in your own environment, identity coverage, how well they fit the tools you already run, the real cost of operating them and how they behave when something goes wrong. Then compare three to five companies on Techarda using recent news, practitioner questions and reviews.
What’s changing in Security
Before you compare anyone, it helps to know what has shifted in the market, because it changes which questions matter.
Platforms are absorbing point products
The larger vendors now bundle endpoint, identity, cloud and network controls under one console and one contract, and price the bundle to make switching look cheap. The question has shifted from "which tool is best" to "how much should one supplier own".
Identity is the main way in
More incidents start with stolen credentials, hijacked sessions or loose SaaS permissions than with malware on a laptop. Identity threat detection and SaaS posture have moved from nice to have into the core of most programmes.
AI assistants have arrived in the SOC
Most vendors now offer an assistant for triage, investigation and query writing. The good ones take real time off routine alerts. Weaker ones restate what the console already showed you, so test them on your own cases.
Evidence matters as much as detection
Disclosure rules, critical infrastructure obligations (in Australia, the SOCI Act and ransomware payment reporting) and board accountability mean you need to show what happened and what you did about it, quickly and in plain language.
What to judge vendors on
Those shifts shape the criteria below. Each one says why it matters and what to ask, so you can take it straight into a vendor call.
| Criterion | Why it matters | What to ask vendors |
|---|---|---|
| 1Detection quality in your environment | Lab results and vendor-run demos rarely match your mix of operating systems, cloud accounts and older systems. Every false positive costs analyst time, every day. | “Can we run a proof of value on our own endpoints and logs for several weeks, and will you share the true and false positive results from that run?” |
| 2Identity and SaaS coverage | If attackers log in rather than break in, a control that only watches devices will miss the start of most incidents. | “Which identity providers and SaaS apps do you monitor natively, and what do you detect when a session token is reused from a new device or location?” |
| 3Fit with your existing stack and data portability | Your SIEM, ticketing and response tooling still need the data. Proprietary formats and export fees make it expensive to change your mind later. | “Can we export raw telemetry and detections in an open schema to our own storage, and what does that cost at our volumes?” |
| 4Response and containment | Detection without fast, safe response leaves your team watching an incident unfold. Automated actions also need to be reversible. | “Which response actions can run automatically, how are they rolled back, and who approves them out of hours?” |
| 5Update safety and vendor resilience | Security agents run with deep privileges. A bad update or a breach at the vendor becomes your incident. | “How do you stage content and agent updates, can we control rollout rings, and how do you tell customers about incidents in your own infrastructure?” |
| 6True operating cost | The licence is only part of it. Tuning, agent upgrades, log ingestion, retention and managed service tiers often cost more over three years. | “What does a team of our size need to run this well, and how do ingestion and retention charges change as our data grows?” |
| 7Data handling and residency | Telemetry contains user names, file paths and sometimes content. Where it lives and who can see it are privacy and sovereignty questions as well as technical ones. | “Where is our telemetry stored and processed, which of your staff can access it, and can we set retention by data type?” |
| 8Reporting for auditors and the board | You will be assessed against frameworks such as the Essential Eight or ISO 27001. If the evidence takes days to assemble, it will be out of date when you present it. | “Which reports map your controls to the frameworks we are assessed against, and can we produce them ourselves without professional services?” |
Trade-offs to settle early
No vendor does well on every criterion, and some pull against each other. Decide where you stand on these before the demos start, or the demos will decide for you.
Platform consolidation or best of breed
One supplier means fewer consoles, one contract and shared context across signals. Specialists often go deeper in their area and move faster. Most teams end up with a platform plus two or three specialists; the real decision is where you draw that line.
Managed service or in-house operation
A managed detection service gives you round-the-clock cover you may not be able to staff. You give up some control over tuning and response decisions, and your team learns less about its own environment.
Agent depth or agentless breadth
Agents see more and can act, but they add deployment work and another thing that can break. Agentless tools cover more ground quickly, especially in cloud, but see less and usually cannot contain.
Automated response or change control
Automatic isolation stops an attack faster. It can also take down a production system at 2 am. Decide in advance which assets can be contained without a human.
One accountable supplier or concentration risk
Consolidating gives you one supplier to hold accountable. It also means one vendor outage or breach touches every control you run at once.
Red flags
As the answers come back, watch for these. One on its own isn’t a deal breaker, but it deserves a follow-up question in writing.
- The vendor will not run a proof of value on your data, or insists on running it without your team watching.
- Detection claims rest only on tests the vendor commissioned or designed.
- Pricing jumps at renewal or scales with ingestion volume without a cap.
- No clear, specific answer about how updates are staged and rolled back.
- Raw data export is locked behind a higher tier or a separate product.
- References come only from organisations much larger or much smaller than yours.
Build your shortlist
Start with the problem, then use Techarda to narrow the field to three to five companies you can compare fairly.
- Write down the one or two controls you are buying and the systems they must cover. Set aside companies whose main focus does not match.
- Include at most one broad platform vendor and at least one specialist, so you can test the consolidation trade-off directly.
- Read each company’s recent stories on Techarda for outages, acquisitions and product retirements, and note what you need to ask about.
- Check the open practitioner questions below. If yours is missing, ask it.
- Compare the shortlist side by side, then run proofs of value with no more than three.
Companies to consider in Security
Listed by recent activity on Techarda (what people are reading, following and discussing). The order says nothing about quality, market share or fit for your needs.
Latest Security stories
Once you have names, recent news is where pricing changes, acquisitions and outages show up first. These are the five newest stories in this category.
SecurityWhy it matters
Threat Actors Use Google Ads To Target Ledger Users
In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. There, a fake…
Security
Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
Security
Two Things Every Cyber Asset Attack Surface Management (CAASM) Tool Needs to Get Right
Cyber Asset Attack Surface Management (CAASM) solved a significant problem. Security teams can now say with confidence what they own. But, two things separate a CAASM tool that stops there from one that actually moves the needle on risk. The first is what the inventory itself carries. The second is what it connects to. 1. An inventory needs to do more than list what exists A list of assets is…
Security
Agents can now set up your website’s security with Turnstile Spin
Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots. Turnstile Spin fixes incomplete setups by using your preferred AI coding agent to wire up server-side verification.
Security
Darktrace / SECURE AI: Behavioral Security for the AI enterprise
Discover how Darktrace / SECURE AI applies behavioral security to AI usage, prompts, agents, and development to help organizations adopt AI securely.
What practitioners are asking
News tells you what vendors announced. These open questions show what teams are still trying to work out, with the least-answered first.
New
What is your approach to managing thousands of edge devices?
Fleet management, updates, security patching and observability at the edge: what tools and practices have held up?
New
Which security investments are you prioritising for FY27?
Identity, cloud security posture, AI security, SOC automation, resilience? Share your top two and why.
New
How are you securing employee use of generative AI tools?
Blocking, allow-listing, DLP, enterprise licences, policy and training: what combination is working in practice?
New
How are you approaching AI governance and model risk management?
Inventories, risk tiers, approval workflows, monitoring. What framework did you adopt and what does day-to-day governance look like?
New
Which skills are you hiring for in FY27 that you were not a year ago?
AI engineering, platform, FinOps, security automation? Share what is on your hiring plan.
Where evidence is thin
A shortlist is only as good as the evidence behind it, and ours is still growing category by category. Here is what’s missing in Security right now.
20 of 20 companies have no published reviews
If you’ve run one of these in production, a short review helps the next team decide. Reviews are moderated before they appear.
7 questions with no answers yet
An answer from someone who has made the same decision is often more useful than any guide. Share what worked, what didn’t and what you’d check next time.
Answer a Security questionFrequently asked questions
What should I ask Security vendors about detection quality in your environment?
Lab results and vendor-run demos rarely match your mix of operating systems, cloud accounts and older systems. Every false positive costs analyst time, every day. Ask: Can we run a proof of value on our own endpoints and logs for several weeks, and will you share the true and false positive results from that run?
What should I ask Security vendors about fit with your existing stack and data portability?
Your SIEM, ticketing and response tooling still need the data. Proprietary formats and export fees make it expensive to change your mind later. Ask: Can we export raw telemetry and detections in an open schema to our own storage, and what does that cost at our volumes?
What should I ask Security vendors about update safety and vendor resilience?
Security agents run with deep privileges. A bad update or a breach at the vendor becomes your incident. Ask: How do you stage content and agent updates, can we control rollout rings, and how do you tell customers about incidents in your own infrastructure?
What should I ask Security vendors about true operating cost?
The licence is only part of it. Tuning, agent upgrades, log ingestion, retention and managed service tiers often cost more over three years. Ask: What does a team of our size need to run this well, and how do ingestion and retention charges change as our data grows?
This guide is written by Techarda editors. No vendor paid to appear in it or saw it before publication. See our methodology, the trust dashboard or go back to the Security hub.