Safeguard
Industry Analysis•

Are vendor-funded security tool comparison studies trustworthy?

Funded comparisons can be useful if the method is open, all tools got equal effort and the funder is disclosed. Here is how to judge one in ten minutes.

Safeguard Security Team
3 min read

They can be, conditionally. A funded comparison deserves trust only when the funder is disclosed, the method and raw data are open, every tool got equal effort, and the study states its limits. Absent those, read it as marketing with numbers attached.

Why funding matters

Funding creates an incentive, whether or not anyone acts on it. Choices that look neutral, like which test applications to use or which configuration to run, can tilt results. A study funded by the party that wins is not automatically wrong, but you should see the work.

The FTC rule on reviews also addresses a related practice: a business cannot misrepresent a website or entity it controls as an independent review source for a category that includes its own products. If a comparison site is operated by a seller in the same category, its independence claim needs to be accurate.

A ten minute test

Score each item yes or no.

  1. Is the funder named near the top?
  2. Is the method published in enough detail to repeat?
  3. Are raw results available?
  4. Were all tools configured with similar effort?
  5. Were tool versions and dates stated?
  6. Were limits and failures reported, including for the funder's own product?
  7. Could another person challenge a result and get an answer?

Five or more yes answers suggest a study worth reading closely. Fewer than three suggest you should treat it as promotion.

Common tilts to look for

  • A test application written by the funder, which reflects the funder's strengths.
  • Defaults for competitors and tuned settings for the funder.
  • Reporting the one metric where the funder wins and omitting others.
  • Dropping tools that failed to run, without saying so.
  • Averaging over categories where the funder is strong.

What a funded study is still good for

It can show how a tool behaves on a defined task. It can show the method the funder believes is fair, which you can reuse. It can also reveal what the funder thinks matters, which is a form of information about priorities.

What to do next

Reproduce a small slice. Run the same test application with your own settings and see if you get similar numbers. If you cannot repeat it, that is a finding. Our guide to fair scanner tests lists what to hold constant.

If you are the one funding a study

Fund the method, not the answer. Publish your funding and your product's results, even when they are not the best. Let a neutral party choose the test cases and keep the raw data available. Invite competitors to review the configuration before publication and fix factual errors. Studies built this way read as credible and last longer, because nobody can dismiss them in one sentence.

Where Safeguard fits

Safeguard offers SBOM and dependency scanning and reachability analysis. The free scan at gold.safeguard.sh/scan lets you produce your own comparison inputs.

Quick check

Is it fine to publish a comparison that I funded?

Yes, with clear disclosure, an open method and equal effort for every tool. Without these, readers will rightly discount it.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.