Two scanners disagree because they read different files, use different advisory sources, match versions by different rules, count duplicates differently and map severity differently. A higher count is not a better scan. Compare them by checking a sample of findings by hand, not by comparing totals.
Seven reasons totals differ
- Scope. One tool scans production dependencies, the other includes dev and test packages. Build tools and test frameworks can add dozens of findings.
- Resolution. One reads the lockfile, the other resolves the manifest. The version it thinks you run may differ.
- Advisory sources. Tools draw on public databases, vendor advisories and sometimes their own research. Coverage and update speed differ by ecosystem.
- Matching rules. Matching a package name and version range to an advisory is not trivial. Renamed packages, forks and distro backports all cause disagreement.
- Counting unit. Some tools count one finding per advisory, others per package, others per path in the tree. The same issue can appear once or ten times.
- Severity. Base scores, vendor adjustments and exploit data can give the same advisory different ratings. A count of "high" findings is not comparable across tools without normalising.
- Suppression and fix state. One tool hides items with no fix available or marks them as accepted. The other shows them.
A fair comparison in four steps
- Fix the scope. Same repository, same commit, same dependency types.
- Normalise the unit. Export results and reduce them to a key such as package, version and advisory ID.
- Compute three sets: found by both, found only by tool A, found only by tool B.
- Sample from each set and verify by hand. For every disputed finding, check whether the installed version is truly affected.
The disputed sets tell you what you need. If tool A's extras are mostly real, tool B has a coverage gap. If they are mostly wrong, tool A has a matching problem.
What good disagreement looks like
Some difference is normal. Wide disagreement concentrated in one ecosystem suggests a parsing issue. Wide disagreement in severity suggests different scoring inputs, which you can examine. Wide disagreement in new advisories suggests a data freshness gap.
What not to conclude
- "The one with more findings is safer." Not necessarily, extras may be false.
- "Both agree so we are fine." Both may share the same blind spot, such as an unsupported ecosystem.
Where Safeguard fits: its dependency scanning and vulnerability management show findings with their package paths so you can verify them, and the free scan gives you a result to put next to your current tool.
Try it yourself
Click through it at your own pace, or open it full screen.
Check how a finding is grouped and what evidence is shown, then consider how you would line it up with another tool's output.
Quick check
Can I just average the two tools?
No. Combine them by unique finding, not by count, and verify the disputed items.
Last reviewed: 19 October 2026.
