GigaOm's current methodology page says each provider is scored through three executive lenses, CTO, CIO and CISO, each carrying 30 percent of the base score, with the remaining 10 percent weighted toward whichever persona matters most in that market. Criteria are a separate pass/fail gate with no score weight.
The gate comes first
The page describes "criteria" as binary requirements that a product must meet before scoring. It calls them a separate pass/fail gate that carries no score weight. Failing one can mean exclusion, and an appeal path exists. The page also calls these requirements "Criteria Primitives" in its steps section.
For a buyer, that means absence from a Radar may reflect a gate, not a low score. A product that fails one binary requirement is not scored at all.
Three lenses
Each criterion maps to one of three executive lenses, which the page ties to budget buckets: CTO (Green Money), CIO (Brown Money) and CISO (GRCS). Each bucket carries 30 percent of the base score. The final 10 percent weights toward the persona that matters most in that market.
Emerging Technology is scored in its own bucket. It informs the velocity label, not the position score.
Why this design is interesting for security buyers
Supply chain security touches all three roles. Engineering leaders care about build speed and developer experience. Infrastructure and operations leaders care about cost and running efficiency. Security and risk leaders care about control and evidence.
A lens model forces a report to say something to each. It also means a product that is strong for the CISO lens and weaker for engineering efficiency could land mid-field even if it is the right fit for a risk-led purchase. Check which lens matters most for your own decision and read the written analysis for that lens.
What the page does not state
The public page does not list the individual metrics inside each lens, does not give report timelines, and does not describe how vendors are selected or whether they pay. I am leaving those out. Ask GigaOm if you need them.
A buyer's weighting exercise
- Decide who owns this purchase: engineering, infrastructure or security.
- Reweight the lenses to match, for example by giving your owner's lens most of the weight.
- Read the criteria in that lens for your must-haves.
- Confirm by testing.
Limits of any lens model
A lens model is only as good as its criteria. If a criterion that matters to you, such as handling of AI agents or an offline mode, is not in the gate or the lens, no amount of reading the chart will reveal it. That is not a flaw particular to GigaOm. It is true of every framework built for a whole market.
Treat the lens weights as a default and apply your own. If your CISO owns the purchase, mentally move weight to that lens and read its written analysis in full.
Quick check
Do pass/fail criteria add points?
No. The page says they carry no score weight. They are a gate before scoring.
Is the 10 percent weight fixed to one persona?
No. It weights toward whichever persona matters most in that market.
Safeguard covers policies, gates and guardrails, and compliance and evidence automation, which map to the risk and governance side of a buying decision.
Sources
Last reviewed: 19 October 2026.
