How we built the closure track: stations, statuses and the hard calls

What is the closure track?

It is the evidence summary behind several of our scores. For each tool we ask whether its own public pages describe six steps: found, owned, proven, contained, routed and rechecked. Each step gets one of three statuses.

• Documented: the vendor's pages describe the step specifically.
• Partial: the step is described only in general terms, in a higher tier, or through another product.
• Not documented: we did not find it on the pages reviewed.

The track is not weighted and not scored on its own. It is published as data, in a CSV file anyone can download, with the source page for every call.

What are the rules?

1. Only the vendor's own pages count: product pages, documentation, pricing pages, press releases and official blogs.
2. A capability sold through another product of the same vendor counts as Partial, not Documented, because the buyer has to buy more.
3. Absence is reported as "not documented", never as "not available". We did not test the products.
4. Every call carries a one-line note and a source.

Which calls were hardest?

• watchTowr, rechecked. watchTowr describes re-testing the hour a new threat emerges. That is re-testing, but not the same as checking the fix the customer made. We marked it Partial and say so in the note.
• Hadrian, owned. Hadrian describes machine learning that confirms asset ownership, but not attribution to subsidiaries. Ownership confirmed, subsidiary not described: Partial.
• Microsoft Defender EASM, owned. Its inventory states describe how confident Microsoft is that an asset belongs to you, not who inside the organization owns it. Partial.
• Censys ASM, proven. Censys confirms reachability and adds EPSS and KEV context. That is more than a version match and less than exploitation. Partial.
• Tenable ASM, contained and routed. Automated remediation and connectors exist in Tenable One, not in ASM alone. Partial on both, by rule 2.
• IONIX, rechecked. Our first read found no retest; the refreshed homepage, read 11 October 2026, states "Instant re-validation of remediated items", so the station moved to Documented and the closes-the-loop score rose from 6 to 8.

What would change a call?

A public page that describes the step. If you work for a vendor, or simply find a page we missed, send it through the contact page with the topic "Correction to vendor information". We check it, update the data and the scores that depend on it recompute automatically.

Why publish the data?

Because a ranking is only as useful as its evidence. The CSV lets anyone check our calls, disagree with them in detail, or build their own view. If you use it, a link back is appreciated.