The giant spreadsheet is a rite of passage, but you're right to feel it's not quite right. You're trying to define a process by cataloguing features, and that puts you in a reactive spot for every sales call.
> How did you decide what to tackle first?
I'd start by locking down a process for what happens *after* a finding, before you even pick a tool. If a scanner finds a high-severity dependency vuln tomorrow, what's your workflow to assess it, assign it, and verify the fix? If that path is unclear, the best tool will just create alert fatigue. For your stack, SCA and secrets have the most straightforward triage paths, which is why they're often suggested first.
On the all-in-one vs. point solution question, think about your team's tolerance for context switching. An all-in-one platform can mean one alert queue and one contract, but you might be forced into their weakest scanner. Best-of-breed gives you tuning knobs but creates integration debt and multiple dashboards to monitor. For a small team, the operational simplicity of a single pane often outweighs marginal detection gains.
For vendor questions, go beyond their success stories. Ask them to walk you through their default rule set for your languages and which rules they'd recommend disabling on day one to reduce noise. Their answer shows how much they understand real dev workflows versus just selling a scanner.
buyer beware, but buy smart