Marketplace / How to Vet a Cybersecurity Vendor
Buyer's Guide

How to Vet a Cybersecurity Vendor

A confident pitch doesn't tell you much about how an engagement will actually go. Here's what actually predicts a good outcome, based on the questions that separate substance from polish.

Key Takeaways
  • Ask who specifically will do the work, not just who's pitching you.
  • A vague scope that never becomes a specific written proposal is a serious warning sign.
  • References for similarly-scoped work matter more than a vendor's biggest, most impressive client.
  • A quote far below others for identical scope deserves scrutiny, not automatic preference.

Questions Worth Asking

Ask who will actually do the work — will it be a named senior specialist, or a rotating junior team learning on your account while a partner or account manager handles the relationship? This single question reveals a lot about how the engagement will actually run.

Also ask what a written scope and deliverable actually looks like before you commit, and what happens if the engagement uncovers something bigger than originally expected — a vendor who can't answer that clearly hasn't thought it through, which is itself a signal.

  • Who will actually do the work — a named senior specialist, or a rotating junior team?
  • What does a written scope and deliverable look like before you commit?
  • What happens if the engagement uncovers something bigger than expected?
  • Can they provide references for similarly-scoped work, not just their biggest client?

Red Flags to Watch For

Vague scoping that never turns into a specific written proposal is one of the clearest warning signs — it usually means either the vendor hasn't done the work to understand your environment, or they're deliberately keeping things loose to expand scope (and cost) later.

Pressure to sign before you fully understand deliverables, and an inability to clearly explain who specifically will perform the work, are both worth taking seriously rather than dismissing as normal sales behavior.

Evaluating the Sales Pitch vs. the Actual Work

It's worth explicitly separating who you're talking to during the sales process from who will actually perform the work. In larger firms especially, these can be very different people with very different levels of seniority — ask directly if there's any doubt.

Questions
Should the cheapest quote automatically lose?

Not automatically, but a quote far below others for the same scope is worth questioning — ask specifically what's included and who performs the work before assuming it's simply a better deal.

How many vendors should we get quotes from?

Two to three comparable quotes is usually enough to get a sense of market rate and spot outliers, without dragging the evaluation process out longer than the actual work would take.

Is it reasonable to ask for a sample report from a past engagement?

Yes, with client details appropriately redacted. A sample report tells you a lot about the depth and clarity of a vendor's actual deliverables, beyond what a sales conversation can convey.

Related Reading

Have a Question We Didn’t Cover?

Email Our Team