SaaS Ranking
Menu

SaaS transparency ranking · Security and compliance

Vulnerability management software

43 vendors · updated 2026-10-17 · 2 without enough data for a score

Vulnerability scanning and application security tools, ranked by what they publish about how they handle your data.

Public transparency score, not a product or security rating. Transparency means: published on the vendor's own site, readable without a login, found by us at the addresses we checked.

+9points above the median of every category we measure

  • Vulnerability management26
  • All categories17
Median transparency score, out of 100. Vulnerability management sits above the median across every category we measure.
  1. A0 0%
  2. B2 5%
  3. C2 5%
  4. D9 22%
  5. E9 22%
  6. F19 46%
41 vendors with a score; 2 more without a score because we could measure too little. Bands have fixed thresholds, see how the score works.
All filters
Show only vendors where we found

Transparency band

2 without enough data for a band

43 vendors

Sort by

Not in the ranking

We could not measure these products with our method, so they are listed here instead of being scored. This says something about our method, not about the vendor.

Narrow it down

Each of these lists the Vulnerability management vendors that meet one condition, with the source for each, and appears only where at least 8 of them meet it.

Shared dependencies

8 of 9 Vulnerability management vendors whose subprocessor list we could read name Amazon Web Services on it, that is 89 %.

Of the 9 Vulnerability management vendors whose subprocessor list we could read, these names appear on the most of them. A vendor without a published list cannot be missing from one, so it is not in the denominator.

Named on the list ofVendorsShareWhat that says
Amazon Web Services 8 89 % 8 of 9 Vulnerability management vendors whose subprocessor list we could read name Amazon Web Services on it.
Salesforce 5 56 % 5 of 9 Vulnerability management vendors whose subprocessor list we could read name Salesforce on it.
Slack 5 56 % 5 of 9 Vulnerability management vendors whose subprocessor list we could read name Slack on it.
Google Cloud 4 44 % 4 of 9 Vulnerability management vendors whose subprocessor list we could read name Google Cloud on it.
Microsoft Azure 4 44 % 4 of 9 Vulnerability management vendors whose subprocessor list we could read name Microsoft Azure on it.
Okta 4 44 % 4 of 9 Vulnerability management vendors whose subprocessor list we could read name Okta on it.
Snowflake 4 44 % 4 of 9 Vulnerability management vendors whose subprocessor list we could read name Snowflake on it.
Atlassian 3 33 % 3 of 9 Vulnerability management vendors whose subprocessor list we could read name Atlassian on it.

This is a naming, not a dependency. A name on a subprocessor list means the vendor published it there. Whether anything actually runs on it, how much of it, and what the fallback is, is on none of these pages. What the figure does show is concentration: if three of your four candidates name the same provider, you have one path and not four.

This category, criterion by criterion

How this market does on each criterion, with its own share and how it compares with the rest.

Every result links its source on the vendor page. A grey segment means we could not measure it, not that it is missing. See how we score.