This Month’s Fortify Experts CISO Forum brought together a group of security leaders to discuss best practices for evaluating and selecting security vendors. Below are the key points we discussed.
1. Vendor Selection Criteria
Align Vendor Choice with Business Needs: Vendors must demonstrate how their product directly supports the business goals and solves specific problems rather than focusing solely on the technology.
One security leader emphasized, “I want to solve a problem, not just learn about a new product.”
Consolidation vs. Niche Tools: Many leaders prefer vendors offering solutions that can consolidate multiple functions to avoid tool sprawl. One CISO noted, “I’m always looking for a vendor who can do more and take the load off, especially tools that bridge gaps beyond just solving technical problems.”
Criticality of Business Alignment: Vendors need to prove their relevance to current business initiatives, risk registers, and security roadmaps. “If a vendor doesn’t align with our top 20 risks, it’s not worth pursuing.” This sentiment was shared by multiple attendees, highlighting the need for security products to align with the business’s risk appetite and operational goals.
2. Vendor Evaluation Process
Peer Feedback Over Vendor Claims: Many CISOs prefer to trust recommendations from peers rather than relying on vendor marketing or cold calls. One noted, “Sometimes I just call a peer to see what they’re using before making a decision.” This highlights the importance of community trust in vendor selection.
Clear Success Criteria: Before engaging in a proof of concept (POC), define what success looks like.
As one security leader pointed out, “Ensure your success criteria is mapped out upfront and stick to it during the POC.”
This reduces the likelihood of scope creep and keeps the evaluation focused on the organization’s core needs.
Simplified POCs: A recurring theme was the time and resource investment required for POCs. Several leaders advocated for streamlined POCs that quickly demonstrate the vendor’s value. “We don’t have time for extensive POCs anymore, so it’s crucial that vendors can provide immediate proof of value,” noted one attendee.
3. Vendor Support and Longevity
Vendor Support Capabilities: It is crucial for critical vendors to provide robust support, including 24/7 availability. One security leader shared a cautionary tale about partnering with a vendor who only provided support Monday through Friday, leading to significant delays during outages.
Third-Party Risk Assessments: Vendors should be evaluated early for their security posture and compliance with industry standards (e.g., SOC 2, ISO certifications). “Involve third-party risk management from the beginning, especially for critical vendors,” one CISO advised, highlighting the need to assess a vendor’s security controls before onboarding.
Emerging Vendor Risks: Many CISOs expressed concern over working with early-stage startups that lack established credentials. One CISO noted, “You can get burned by a startup if they get acquired or fail. It’s critical to weigh whether they have staying power.” However, these smaller vendors may offer innovative solutions and may be willing to tailor their products to your needs.
4. Handling AI Vendors and New Technologies
AI Vendor Caution: With the explosion of AI vendors, many CISOs are hesitant about partnering with unproven companies. One CISO remarked, “It’s hard to know what they are doing with our data, and we need to vet them more thoroughly.” This includes looking at their long-term strategy, data handling practices, and the maturity of their solutions.
AI and SaaS Integration: Some security leaders are exploring tools that combine AI security with SaaS management, noting that “a lot of these technologies overlap, and there’s value in tools that handle both areas efficiently.”
5. Best Practices in Vendor Relationships
Transparency and Accountability: Building a trusted relationship between vendors and CISOs requires transparency. Vendors should be upfront about their limitations, the most frequent support calls, and where they struggle.
One leader shared, “If a vendor can’t answer basic questions about their most common support issues, it’s a red flag.”
Mutual Trust: Establishing a mutually beneficial relationship, where both sides understand expectations and needs, is essential. Vendors who are open about their business goals, support capabilities, and potential challenges foster better long-term partnerships.
Conclusion
The security leaders at the CISO Forum shared a consistent theme: vendor selection is more than just evaluating the technology.
It involves:
- aligning vendor capabilities with business goals,
- assessing their long-term viability,
- providing the necessary support for critical business functions.
Vendors must offer immediate value and align with predefined success criteria while being transparent about their limitations.
Fortify Experts hosts CISO Forums and works with security advisors every day.
Download our Free Insider’s Guide on How to Hire a Great CISO.
By focusing on these strategies, organizations can significantly improve their security posture and be better prepared to handle future cybersecurity challenges while achieving and maintaining CMMC compliance.
About Tim Howard
Tim Howard is the founder of 4 technology firms including Fortify Experts which helps companies create higher-performing teams through:
- People (Executive Search and vCISO/Advisory consulting),
- Process (NIST-based security assessments and Leadership Coaching),
- Technology (Simplifying Security Solutions).
How I can help you:
- Join over 30,000 People Getting Free Security Leadership Improvement Advice – Follow me on LinkedIn. www.linkedin.com/in/timhoward
- If you want to hire a great security leader, download our free ebook on How to Hire a Great CISO.
- If you want to quickly assess your Cybersecurity Maturity Level or Need a Strategic Improvement Roadmap, Contact me.
- If you are looking to simplify cybersecurity, check out Fortified Desk. This Zero Client enables secure, instantly deployable, BYOD workspaces.
- Come be a part of the discussion in our Monthly CISO Forums.