Choose deployment by who carries the operational burden and where your data may live. SaaS is the least work for you, self-hosted moves hosting to you but keeps the vendor's software, and on-prem means inside your own data centre. Ask each vendor which models are generally available today, not planned.
Three models, defined
SaaS means the vendor hosts and runs everything. Self-hosted means you run the vendor's software in your own cloud account or cluster. On-prem is self-hosted inside infrastructure you physically control, often with no internet access. Some vendors blur these terms, so ask for a plain description of who patches what.
Questions that expose the real model
| Topic | Ask |
|---|---|
| Availability | Is this deployment option generally available now, or on a roadmap? |
| Parity | Do self-hosted customers get the same features as SaaS? |
| Upgrades | Who performs them, how often, and with what downtime? |
| Dependencies | What must exist already: database, queue, container platform? |
| Sizing | What hardware does a team of our size need? |
| Updates to data | How does vulnerability data reach an isolated install? |
| Support | Can support help without access to our environment? |
Feature parity is the question most often answered loosely. A self-hosted build can lag the hosted one, and the lag shows up at the worst moment, such as when a new class of finding appears.
Hidden costs of running it yourself
Self-hosting a security tool means you now have a production service that needs backups, patching, monitoring and an on-call owner. It also needs its own security review, because a scanner holds a map of your weaknesses. Count that staff time against the licence difference. Our worksheet on build versus buy cost is a useful template.
When SaaS is acceptable and when it is not
SaaS usually fits when your policy allows vendor processing of metadata, and the vendor can describe what data it stores. It may not fit if your contracts forbid code leaving your network, or a regulator expects processing in a named place. Either way, ask for the data flow in a diagram, not a sentence.
Steps to decide
- Write your hard constraints: data location, network isolation, audit needs.
- Ask every vendor the table above in writing.
- Eliminate options that cannot meet a hard constraint today.
- Compare the remaining options on operational effort and support.
- Confirm in the trial that the deployment you will use is the one you test.
Step five matters because a demo on the hosted version proves nothing about a self-hosted install.
Quick check
Is self-hosted more secure than SaaS?
Not automatically. You gain control of data location but also take on patching and hardening duties.
Can an air-gapped install still get new vulnerability data?
Only if the vendor has a defined offline update path. Ask how it works and how stale the data can become.
Safeguard publishes its available surfaces on its download page, and you can check a project with the free scan at gold.safeguard.sh/scan. Ask us about deployment options for your constraints.
Last reviewed: 19 October 2026.
