A recent study by AV-Comparatives (commissioned by the Austrian Economic Chambers) analyzed 14 leading EDR-EPP vendors on transparency metrics: source code access, SBOM availability, telemetry controls, staged updates, on-prem reputation services, and data residency.
The raw numbers are one thing. But the study also found a correlation worth discussing: vendors with higher transparency scores tended to perform better on vulnerability handling, incident disclosure timelines, and overall security maturity.
In other words, how vendors treat transparency says something about how they treat security.
Three findings stood out to me:
Only 3 vendors allow enterprise customers to review source code. Those same vendors also had better-than-average vulnerability disclosure practices.
