Ask any vendor which sources feed their vulnerability data, how long a new advisory takes to appear in scan results, and what happens for issues that have no official identifier. Then measure it yourself: pick a recent advisory and time how long each tool takes to flag a project that uses it.
What "vulnerability data" is made of
A scanner compares your packages with a database of known problems. That database is built from sources such as the public CVE and NVD records, ecosystem advisory databases, vendor bulletins, and in some cases the vendor's own research. Each source has different speed and coverage. A single source rarely tells the whole story, and some advisories never receive a CVE identifier at all.
The post on advisories without CVE IDs by ecosystem shows why that matters.
Questions for the vendor
| Question | What a clear answer sounds like |
|---|---|
| Which sources do you ingest? | A named list, not "industry feeds" |
| How often is data updated? | Continuous or a stated interval |
| What is your typical lag after a public advisory? | A measured range, with how it is measured |
| Do you add your own research? | Explain what, and how it is labeled |
| How do you handle conflicting records? | A stated rule |
| Do you include exploit signals such as known exploitation or probability scores? | Which ones, and how often refreshed |
| What do you do when a record is withdrawn? | Findings should disappear, with a note |
Freshness is not the same as accuracy
A fast feed full of duplicates and wrong version ranges produces false alerts. A slow, careful feed misses live threats. Ask about both. One useful probe is how a vendor corrects a wrong version range after the fact, and whether customers are told.
A test you can run yourself
- Choose three advisories published in the last two weeks, from different ecosystems.
- Build a tiny test project that uses an affected version of each.
- Scan it with each tool you are evaluating, at the same time of day.
- Record which tool flagged each, and note the severity and fix guidance shown.
- Repeat after a week with new advisories.
This is a small sample, but it is your own evidence, and it beats any marketing claim. Keep the results next to your proof of concept success criteria.
Zero-day discovery is a different promise
Some vendors claim to find vulnerabilities before public advisories exist. If you hear that, ask how those findings are validated, how they are disclosed to maintainers, and how they are labeled in your results so you can tell them apart from public records.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how an emerging issue is surfaced and ask each vendor how long that same path takes in their product.
Quick check
Is NVD enough as a sole data source?
Rarely. Ecosystem advisories and vendor bulletins often carry details NVD lacks or publishes later.
Can a scanner show real time results?
It can re-check your inventory against new data continuously, which is different from rescanning code. Ask which one is meant.
Safeguard offers zero-day discovery and SBOM and dependency scanning; try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
