COMPARISONS
Two questions, kept apart
Governing an agent while it works and scanning a repository before anyone runs it are different problems with different tools, and putting them in one table is how a reader ends up with the wrong idea of every product in it. So they are two pages.
RUNTIME GOVERNANCEWhat actually stops an agent mid-taskFour ways to sit between an agent and the machine it is working on. They are not four versions of the same product: each one stands in a different place, and where a tool stands decides what it can possibly see. Read the stances first, because they explain every row that follows.REPOSITORY SCANNINGWhat each scanner actually looks atFour tools that all get called security scanners, and that do not read the same files. This page is only about what can be found in a repository before anyone runs anything. Nothing here is about governing a running agent.
Every cell is measured against the other tool's own source or documentation, at the version named on the page. Where node9 does not cover something, the row says so and stays in the table.