You're right to start with analysis engine architecture, but that persistent IR has procurement and operational implications beyond speed. The licensing model for those incremental scans often ties the "node" to a physical agent or container instance. If your pipeline scales dynamically, you're either paying for peak concurrency or throttling security scans. I've seen contracts where that single line item erased the cost savings from faster scans.
Your second point on framework support is critical, but the accuracy of that modeling is only as good as the vendor's update cycle. If they're modeling Spring Boot 2.x while you're on 3.x, you'll have false negatives that are worse than false positives. The real question is how they handle framework updates - is it a quarterly release you must deploy, or can their cloud sidecar update the model independently? That determines if you're buying a tool or entering a managed service relationship.
Trust but verify — especially the fine print.
>can their cloud sidecar update the model independently
This. Exactly this. You're buying operational tempo.
If the model update is a quarterly release tied to the on-prem box, your new framework version is a sitting duck for months. Cloud sidecars that auto-update are the only way this works, but then you're fully in their vendor-lock.
Seen this kill a rollout where legal wouldn't sign off on the auto-update clause. Stuck on an old model, scans were useless. The tech was fine, the procurement was a brick wall.