How Valydex evaluates security and products

Methodology 2026-09-22.1. Our self-assessment helps prioritize work. It is not a penetration test, certification, compliance decision or measurement of the probability of a breach.

Scoring and coverage

Platform, business size, subscription and IT support are context, not security points. Each known control answer earns its defined option score, multiplied by the question weight. We normalize within each NIST function and combine assessed functions using the weights below.

• GOVERN: 15
• IDENTIFY: 15
• PROTECT: 35
• DETECT: 15
• RESPOND: 12
• RECOVER: 8

Unknown or unanswered controls are excluded from the score and reported in coverage. Inapplicable questions are excluded. A high score with low coverage is incomplete evidence, not an assurance of protection. Scores across different tiers or versions should not be treated as directly comparable.

Answers below 60% of a question’s maximum identify a gap. The weakest answer determines the category severity; a category with a gap is not also labeled a strength. These thresholds and weights are Valydex editorial choices, not NIST scoring rules. We publish no industry averages or percentiles without a supported dataset.

We use NIST CSF 2.0 small-business guidance to organize questions and CIS IG1 as practical prioritization guidance. Category mappings do not claim full coverage of every framework outcome.

Product research

We distinguish vendor-documented facts, editorial fit judgments and hands-on testing. A source-reviewed label means the cited documentation was checked on that date. It does not mean we independently tested every vendor claim. Commission and featured status do not determine assessment suitability.

Numeric prices require a named plan, currency, term and dated official source. They expire after 30 days; other source-reviewed claims are due for review after 90 days. Cost examples exclude taxes, deployment labor and unspecified add-ons. Dynamic checkout prices are not guessed.

Shortlists explain suitability and limitations without assigning unsupported numerical rankings. Customer review aggregates are not substitutes for a security evaluation.

Privacy and funding

Scoring and PDF export run in your browser. Optional AI uses external processing only after consent. Analytics events exclude answers and scores. Product links may earn a commission; non-affiliate options remain eligible.

Privacy details · Affiliate disclosure · Start an assessment