The instrument

These are the nine.

• Security or trust page
• Vulnerability disclosure route
• Sub-processor list
• Breach notification terms
• SOC 2
• ISO 27001
• Penetration testing
• MFA or SSO
• Email authentication

Nine things a buyer can check about a software vendor without asking the vendor anything. Every one of them is either on a company’s public pages or it is not.

That is the whole method. No surveys. No questionnaires. Nothing self-reported, and nothing anybody had to cooperate with — which is exactly why the answers are comparable across 147 brands.

Two rules we hold ourselves to. A page we could not reach is recorded as unknown, never as absent — negatives are a floor, not a census. And a badge is recorded as a claim, not as a security page.

The full study publishes in October 2026.