"Managed" is not one thing. It can mean the vendor hosts the software, curates the data, operates the pipeline, answers support tickets, or takes responsibility for outcomes. Ask which of those five you are getting, in writing, because each moves a different piece of work off your team.
Why the word needs unpacking
In sales conversations, managed sounds like "someone else handles it". In practice the handover is partial. If you assume the vendor does something that stays with you, a gap opens, and gaps in security tooling tend to be found during an incident or an audit.
Five levels
| Level | What the vendor does | What stays with you |
|---|---|---|
| 1. Hosted | Runs the servers and the application | Configuration, rollout, triage, data quality questions |
| 2. Curated data | Collects and normalises advisory data, adds matching logic | Checking freshness, deciding policy on uncertain records |
| 3. Operated | Handles upgrades, scaling, scanning infrastructure, uptime | Integrations in your CI, tokens and access |
| 4. Supported | Provides a defined support path with response targets | Providing reproducible cases, internal escalation |
| 5. Outcome based | Takes on stated results, such as fixes delivered or items closed | Review and merge decisions, risk acceptance |
Most platforms deliver levels one to three, many offer four, and level five varies widely. Treat any claim of level five with extra questions: what exactly is the outcome, how is it measured, and what is excluded.
How each level compares with open source
An open source scanner gives you the engine and, often, public data, but every level above is yours to supply. You host it, curate or choose the data, operate the pipeline, and provide your own support by reading issues and fixing problems. That can be a good trade for a team with spare engineering capacity and a clear owner.
A managed platform changes who does the work, not whether the work exists. Our post on what a managed open source SLA should cover gives questions for the support and outcome levels.
Questions to ask per level
- Hosted: where does it run, and can you choose a region?
- Curated data: what are the sources, and how is freshness measured?
- Operated: what is the uptime target, and where are the status and incident notices?
- Supported: who responds, in what time, for which severities, and is it in the contract?
- Outcome based: which outcome, measured how, and what is your obligation?
Decide which levels you need
Write down the five rows and mark each as "we do it", "vendor does it" or "shared". If you cannot fill in a cell, that is the question for the next vendor call. Revisit the table at renewal, because needs change as a team grows.
Safeguard offers dependency scanning, policies and gates, compliance evidence automation and optional fix pull requests, which are off by default, so teams control how much is automated. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does managed mean the vendor is responsible for my security outcomes?
Not by default. Read the contract. Responsibility is usually limited to the service, with the use of the results remaining yours.
Is a hosted tool the same as a managed one?
Hosting is the lowest level. A managed offer should also say who handles data quality, operations and support.
Last reviewed: 19 October 2026.
