The methodology sets the criteria; this is the process our analyst actually runs against each company before it's scored.
Pull every public certification, analyst placement and CVE credit for the vendor from primary registries — not the vendor's own marketing claims.
Read the vendor's own technical and compliance documentation to confirm the delivery model and domain coverage they claim matches what's actually shipped.
Any client reference or case study cited must be independently findable — a press release, a named testimonial or a public filing, not an unverifiable anecdote.
Each of the five methodology criteria is scored 0–10 and combined by its published weight into the final score shown on the ranking page.
Every listed company is re-verified each quarter; a material change (a lost certification, a new analyst placement) can move a company's tier immediately.
See the specific registries, analyst reports and disclosure sources this process draws on.