Safeguard
Security Guides•

How do you handle roadmap promises when buying an AppSec tool?

Separate generally available features from beta and roadmap items in a purchase. How to ask, test and write conditions so you pay for what works now.

Safeguard Security Team
3 min read

Ask the vendor to label every feature you rely on as generally available, early access or roadmap, test the generally available ones in your pilot, and keep roadmap items out of your core requirements. If a roadmap item is decisive, tie it to a dated commitment with a remedy in the contract.

Definitions

  • Generally available (GA): released to all customers, supported, and covered by normal terms.
  • Early access or beta: available to some customers, may change, may have different support or terms.
  • Roadmap: planned, not shipped. Dates move.

Sales conversations blur these. A demo can show a prototype, and a slide can show a plan. Neither is a feature you can use on Monday.

Step 1: List what you actually need

Write your must have requirements before vendor calls. Number them. For each one, ask the vendor for the label and the release version or date. Keep this as a simple table you fill in together.

RequirementVendor labelEvidenceTested in pilot
SSO with group mappingGADocs linkYes
Reachability for one languageEarly accessDemo onlyPending
Custom report formatRoadmapVerbalNot testable

Step 2: Test only what exists

Your pilot should exercise GA features on your own code. If a requirement is early access, note it as such in the readout and score it separately. A pilot that quietly includes a beta feature can produce results you cannot reproduce after purchase.

For a method, see pilot success criteria before the trial.

Step 3: Handle roadmap items honestly

Some roadmap items are fine to wait for. If one matters:

  1. Ask for the target date in writing, with the caveat language the vendor uses.
  2. Ask what happens if it slips: a term adjustment, a right to terminate, or a credit.
  3. Make sure the order form lists the item as a condition, not a hope.
  4. Set a review date inside your own team to check delivery.

If the vendor will not put it in writing, treat it as not promised.

Step 4: Watch the exact wording

Be careful with phrases like "supports", "integrates with" and "AI powered". Ask what that means in practice: which versions, which languages, which actions. A listed integration may be a webhook, not a deep integration.

Step 5: Keep your own claims accurate

If your team later tells auditors or customers about controls the tool provides, those statements must match what is live. A roadmap feature cited as a control is a finding waiting to happen.

Safeguard publishes its available capabilities, and you can try a free scan at gold.safeguard.sh/scan.

Quick check

Is early access acceptable in a purchase?

Yes, if you accept the different support terms and do not rely on it for a required control.

How do I get a roadmap date in writing?

Ask for it in the order form or a side letter with the vendor's usual caveat, plus a stated remedy if the date slips.

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.