How We Evaluate Software
MethodologyUpdated September 2026
CyberPicks publishes comparisons and buying guides for security-conscious teams and individuals choosing cybersecurity tools. This page explains exactly how we reach our conclusions — and, just as important, what we do not claim to do.
The short version
Our reviews are analysis-based. We study product documentation, verify published pricing directly on vendor pricing pages, and compare published product specifications. We do not run laboratory benchmarks, and we do not pretend to. When a claim in our guides comes from a third party, we say so.
What we actually do
Every guide on this site follows the same four-step process:
- Feature & spec analysis. We read the vendor's own documentation, feature lists, and changelogs to establish what each product actually does — as opposed to what its marketing page implies.
- Pricing. We publish the vendor's listed prices as they appear on the vendor's own pricing page when a guide is written, and we note billing tiers, minimum seats, and hidden costs (onboarding fees, add-ons, price-per-feature traps). Prices move constantly, so treat every figure as indicative and confirm it with the vendor before you buy.
- Documented limits and trade-offs. We read the vendor's own documentation, stated limits and changelog history, and we quote published independent lab results where the category has them, naming the lab and the test period. We do not scrape or aggregate G2, Capterra or TrustRadius scores, and we do not run hands-on lab tests ourselves. Where a guide quotes a third party, it says so.
- Category comparison. Finally, we line the finalists up side by side — features, real costs, user sentiment, and fit for specific team sizes — and explain who each tool is right for, not just which one is "best."
Our scoring dimensions
When a guide includes scores, they are weighted as follows:
| Dimension | Weight | What we look at |
|---|
| Detection coverage | 25% | Documented detection rates from independent labs (AV-TEST, AV-Comparatives, SE Labs) |
| Core features | 20% | Real-time protection, firewall, sandboxing, EDR/XDR coverage |
| Pricing transparency | 15% | Per-device vs per-user, multi-year discount clarity, renewal pricing |
| Ease of use | 15% | Onboarding, false-positive rate, dashboard clarity |
| User satisfaction | 15% | Vendor-published case studies and publicly documented product limitations |
| Independent lab results | 10% | Public AV-TEST/AV-Comparatives scores and false-positive reports |
Where our data comes from
- Vendor documentation, pricing pages, and changelogs
- Published documentation
- Independent lab results: AV-TEST, AV-Comparatives, SE Labs, MITRE ATT&CK evaluations
- Vendor security disclosures (SOC 2, ISO 27001, GDPR compliance)
What we don't do
- We don't run our own malware detection tests. We cite independent labs that do.
- We don't claim hands-on testing on deliberately infected machines. Our coverage is analysis-based.
- We don't accept paid placements or "review fees" from vendors. No vendor sees a review before it publishes.
- We don't collect our own user reviews. We do not publish user-satisfaction scores, because we have no first-party survey data to base them on.
How affiliate links interact with our ratings
Some links on this site are affiliate links: if you buy through one, the vendor pays us a commission at no extra cost to you. Commission rates never influence scores or rankings — our full affiliate disclosure explains the details, including how we handle products we have no financial relationship with.
Updates & corrections
Pricing and features change constantly. We re-check every guide at least quarterly, and sooner when a vendor ships a major release or price change. If you spot an error, email corrections@cyberpicks.org — verified corrections are published within five business days, with a note.