Tidelift: cybersecurity software

Of all the companies in this space, Tidelift is the only one I could describe as uniquely ethical. If you're tired of shoveling your CVE scanner results into open source backlogs, never to be fixed, working with Tidelift allows you to actually work with maintainers to get your issues fixed upstream - while checking the box on standard SCA feature sets (plus a few unique package health assessments).

What Tidelift is

Of all the companies in this space, Tidelift is the only one I could describe as uniquely ethical. If you're tired of shoveling your CVE scanner results into open source backlogs, never to be fixed, working with Tidelift allows you to actually work with maintainers to get your issues fixed upstream - while checking the box on standard SCA feature sets (plus a few unique package health assessments). The vendor site is tidelift.com. This profile is an entry in the oneNorma directory, not a vendor landing page.

What Tidelift covers

Tidelift is in the catalog for these capabilities. Categories: SCA. Catalog tags: Open Source, Acquired, and Best for Enterprise.

How to evaluate Tidelift in a security program

Use Tidelift as a stack candidate, not as diligence evidence. The oneNorma score for Tidelift is 5.8/10 (percentile 75). If the real gap is in SCA, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what tidelift.com publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

SCA

Tags

Open SourceAcquiredBest for Enterprise

Frequently asked questions

What is Tidelift?

Of all the companies in this space, Tidelift is the only one I could describe as uniquely ethical. If you're tired of shoveling your CVE scanner results into open source backlogs, never to be fixed, working with Tidelift allows you to actually work with maintainers to get your issues fixed upstream - while checking the box on standard SCA feature sets (plus a few unique package health assessments). Site: tidelift.com.

Which categories does Tidelift fall into?

Tidelift appears in the oneNorma directory under SCA. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement Tidelift?

No. The Tidelift profile (tidelift.com) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.