Another analysis of Larry Suto's comparative review

IBM/Watchfire released their analysis of Larry Suto's web scanner comparative review, which was released in October.  If you recall, we wrote one as well.  IBM/Watchfire questioned Suto's methodology just like we did; they also found discrepancies between their own testing and the scan files Suto provided them (yes, that's right--Suto's reported results apparently don't match Suto's own scan files).  Interesting is their discussion on how vulnerabilities are counted (issues vs. instances), and their knowledge of how NTOSpider apparently counts its findings (it counts instances), causing a higher/inflated vulnerability finding count.

Overall, Suto's analysis illustrates an important concept: testing and product comparisons are not trivial to perform.  You need a sound methodology, and you need to make sure your numbers and math make sense.