A good RFP asks for evidence, not adjectives. These twenty questions are grouped so you can drop them into a spreadsheet and score the answers. Ask vendors to answer in writing, then test the claims that matter in a pilot.
Coverage
- Which languages and package managers do you support, and at what depth (manifest, lockfile, build resolution)?
- Do you read lockfiles, and which versions of each format?
- How do you handle monorepos with several lockfiles?
- Do you scan container images and binaries, and how are layers handled?
- What can you not see, and how do you report it?
Accuracy and noise
- Where does your vulnerability data come from, and how fast do new advisories appear?
- How do you match advisories to packages and versions?
- Do you offer reachability analysis, for which languages, and how does it treat dynamic code?
- Which exploit signals do you show, such as known exploitation or exploit probability?
- Can we run a joint test on our own repositories and review the results together?
Workflow
- How does the tool run in CI, and what controls the exit code?
- What do developers see on a pull request?
- Do you offer fix suggestions, and do changes require approval?
- How do you rescan existing projects when new advisories appear?
SBOM and licenses
- Which SBOM formats can you import and export, and which versions?
- Does your output include the NTIA minimum data fields, and can you show an example?
- How do you report license findings and mismatches?
Data handling and terms
- What leaves our network during a scan, and where is it stored?
- What drives price: developers, repositories, scans, or something else, and how does it change as we grow?
- How can we export our data if we leave?
How to use the answers
Weight each section as in the scorecard guide. Mark any answer you cannot verify as "claimed" and test the important ones. For SBOM questions, check outputs against the minimum elements checklist.
Ask for references from customers of a similar size, and call at least one.
Red flags in answers
- "We support everything" with no list
- Reachability described without any language detail
- Pricing that cannot be explained in two sentences
- No way to export findings
- Refusal of a test on your own code
Safeguard offers SBOM and dependency scanning with reachability analysis, and you can start with the free scan at https://gold.safeguard.sh/scan before you write the RFP.
Scoring the answers
Give each answer one of three marks: evidence provided, claim only, or no answer. Give evidence full credit, claims half, and silence none. Then pick the three claims with the most weight in your scorecard and test them yourself. Share the scoring method with vendors in advance, since clear rules produce better answers and fewer arguments afterward. Keep the completed sheet, because it becomes the baseline for contract renewal and for any future comparison.
Quick check
Should the RFP include a pilot?
Yes. Make a pilot on your own repositories a condition for the shortlist.
Last reviewed: 19 October 2026.
