Enterprise Review Methodology

We do not publish an enterprise editorial score or ranked winner without a verified evidence set for the claims that score depends on. Vendor marketing, public partner pages, and affiliate or CPL eligibility are never treated as acceptance or as a scoring input.

When a page says "we tested," it must identify scope, version, environment, date, and limitations. We do not invent testing hours, customer counts, detection rates, or partner wins.

Material claims should carry one of these labels from the enterprise methodology pack: vendor-documented, independently tested, demonstration observed, trial evaluated, controlled deployment tested, practitioner interview, or editorial inference.

Editorial inference is the weakest label and must not be dressed up as a lab result. Conflicted or missing evidence slots keep scores unpublished.

Prefer official product, legal, and security documentation; then independent laboratory or standards evidence; security audits and certifications; controlled demonstrations; trials and deployments; verified practitioner evidence; then reputable reporting.

Draft E006 packs may exist for P0 vendors while scores remain closed. A filled pack is research progress, not a published ranking.

Buyer-fit shortlists and assessment routing can use company context without inventing editorial scores. Lead routing stays editorial_only until partner adapters and program acceptance are verified.

Affiliate, CPL, or channel payout cannot raise a vendor above another on a best-of or comparison page.

We refuse fabricated detection percentages, guaranteed compliance outcomes, invented SLA response times, fake customer logos, and "hours tested" theater. We refuse to treat unfinished AI copy as finished methodology.

We refuse to invent ACSC Essential Eight Maturity Levels, live CVE scan results, CVSS certifications, or partner acceptance from self-assessment tools or pending verification hubs.

Consumer methodology at /methodology/ and /how-we-test/ remains the public consumer rule set. Enterprise pages add procurement evidence labels and commercial separation on top of those rules.

Company-specific outcomes should start with assessment, stack builder, shortlist, budget, or RFP tools, then category builders (password, endpoint, MDR, email, PAM, ZTNA, resilience, vulnerability, compliance). Category commercial product pages are supporting drafts, not the primary decision surface while scores are unpublished.

Free and built-in controls still come first: MFA on identity providers, patching, backups you can restore, email authentication, inventory ownership, and critical-finding SLAs where applicable.

Enterprise commercial product pages may list plan names and pending verification commercial notes, but editorialScore stays null / unpublished until reviewer-approved evidence sets clear the score gate. Vendor-documented pricing is not a ranking. Quote-only seats stay quote-only.

next stage and Phase 3 hubs (including privileged access, zero trust, cyber resilience, and vulnerability management) are navigation drafts. Empty source registers stay empty. Comparisons and best-ofs must keep affiliate, CPL, or channel payout out of ordering logic.

A public partner or marketplace badge is not Security Checklist program acceptance and not an editorial score. Keep lead routing editorial_only until adapters and acceptance are verified.

Who should not treat partner pages as purchase proof: anyone equating co-marketing with independent testing.

Interactive enterprise tools show workflow readiness estimates from your answers only. That figure is not a product editorialScore, not an ACSC Maturity Level, and not a live CVE or penetration-test result.

Who should not buy from the percentage alone: anyone skipping free MFA, inventory ownership, or restore drills because a draft tool looked green.

Enterprise methodology adds evidence labels and commercial separation on top of consumer honesty rules. Overall scores stay unpublished (unpublished) until evidence sets clear. Workflows (assessment, shortlist, budget, RFP, and category builders) come before vendor shopping. This route stays unpublished; INDEXABLE_PATHS is not expanded here.