KuppingerCole rates products on five categories, Security, Functionality, Deployment, Interoperability and Usability, and vendors on Innovativeness, market position, financial strength and ecosystem. Ratings use a five-level scale from Strong positive to Critical. Product categories are weighted heavily because weaknesses add manual effort, cost and error risk.
Product and service categories
Per the methodology page, the product categories are:
- Security
- Functionality
- Deployment
- Interoperability
- Usability and customer experience
The page says these are weighted heavily because weakness in them increases manual effort, cost and the risk of errors. That is a practical framing. A scanner that does not integrate with your pipeline costs people time, whatever its detection quality.
Vendor categories
Vendors are rated on innovativeness, market position, financial strength and ecosystem, meaning partners, resellers and integrators. These feed the Market and Innovation leader views.
The five levels
Ratings use five labels: Strong positive, Positive, Neutral, Weak and Critical. The page says most ratings apply to the specific product and market segment, not to the vendor overall.
How to read ratings against your needs
Take your top requirements and place them under these headings.
- Requirement: Runs in our air-gapped environment. Likely rating category: Deployment
- Requirement: Works with our CI and ticketing. Likely rating category: Interoperability
- Requirement: Developers will actually use it. Likely rating category: Usability
- Requirement: Covers our languages and ecosystems. Likely rating category: Functionality
- Requirement: Data handling and access control. Likely rating category: Security
Then read the individual ratings for each shortlisted product. A product with a Weak in Deployment may be fine if you run SaaS only, and a poor fit if you need self-hosting.
Caveats
I could not retrieve the detailed per-category criteria for any specific report, and these can vary by segment. KuppingerCole's page also states that the report alone is not enough to choose a vendor and that you should analyze your own requirements and map them to offerings.
Turn it into a scorecard
- List requirements with owners.
- Assign each to one of the five product categories.
- Rate each shortlisted product yourself on the five-level scale during a test.
- Compare your ratings with the report's and investigate differences.
Why weighting Security and Deployment heavily is a useful default
KuppingerCole says product categories are weighted heavily because weakness in them raises manual effort, cost and the risk of errors. In supply chain security, think of a tool that cannot deploy where your code lives, or that needs manual steps to export evidence. The detection quality might be fine, but the daily cost shows up elsewhere.
When you score products yourself, keep the same lens. Ask how many hands touch each finding between detection and fix.
Quick check
What is the lowest rating on the scale?
Critical, below Weak, Neutral, Positive and Strong positive.
Does a rating describe the whole vendor?
Mostly no. Most ratings apply to the specific product and market segment.
Safeguard's CLI, IDE extensions and CI-friendly policies and gates are GA surfaces you can score under Interoperability and Usability.
Sources
Last reviewed: 19 October 2026.
