Test your exit before you sign. Ask for a full export of findings, suppressions, custom rules, policies and audit history in an open format, and try one during the pilot. If the export is partial or paid, price that into the decision and negotiate it into the contract.
What you will want to take with you
When teams switch tools, the painful losses are rarely the scan engine. They are the accumulated decisions:
- Suppressions and accepted risks, with reasons and expiry dates. Losing them means developers see old noise again.
- Custom rules and policies, which encode your standards.
- Finding history, needed to show remediation trends and audit evidence.
- SBOMs and attestations you have already issued to customers.
- Ticket links, so old issues still point at the right findings.
- Configuration, such as projects, teams, and gate settings.
Check the formats
Open, documented formats make a later migration possible. For results, SARIF is a common interchange format for static analysis. For bills of materials, CycloneDX and SPDX are widely used. Ask which the tool exports, whether the export includes every field, and whether it covers history or only the latest scan.
Try it. Export from the pilot, then diff the counts against the console. Differences point at fields that do not survive.
Contract terms to ask for
- A defined period after termination to retrieve data, with the vendor's help
- Deletion of your data on request, confirmed in writing
- No fee for standard exports
- A cap on renewal price increases
- Notice before an end of life for any feature you depend on
- Termination rights if data handling terms are breached
Have counsel review the wording. These are asks, not guarantees, and vendors will differ.
Reduce lock in on your side too
- Keep rules and policies as code in your own repository where the tool allows it
- Store gate logic in your CI configuration, not only in the vendor console
- Save SBOMs you publish in your own storage
- Record suppression reasons in a place you control, not only in the tool
Run a mini migration test
During the pilot, take one project and recreate its results in a second tool or a spreadsheet using only the export. If that takes a day, the exit is realistic. If it takes a month, you have found your real switching cost, and it belongs in the score. See the pilot plan for where to fit it.
Why vendors rarely volunteer this
Switching cost helps retention. That is not villainy, it is just incentive. Asking early, in writing, in front of your procurement team makes the answer a contract item instead of a sales conversation.
Quick check
Is an API enough instead of an export?
Often yes, if it exposes full history and is rate limited generously. Test it by pulling everything for one project and checking completeness.
Should exit planning count in scoring?
Yes, as a scored category with its own evidence, usually a modest weight.
Last reviewed: 19 October 2026.
