The Fallacy of the Best Product
Why not everything that shines is gold when buying Technology? A lesson in vendor selection.
If you are a company that purchases technology products, like firewalls, cloud services, EDR, SASE, CASB, etc., you may have been in a situation when a vendor trashed other vendors to sell their product. Sometimes they show you all the features of theirs compared with others that don’t have them, or the time they’ve either been in the market or for how long their product has existed. Some may also bring the Gartner quadrant to show where their product is positioned against others if by any chance they are in the top right one.
I face this constantly, and several times I had to stop the salesperson and bring them down to planet Earth. We all understand that you want to reach your quota, or you just need to position yourself in your employer’s mind. But not all the time is your product the one that fits my company. This is sometimes frustrating when you end up tied to a contract looking for a new vendor, and then you find out you either are paying too much, using only a few features, or you are just chained to this vendor for what the contract says, with no chances of leaving without paying a hefty fine. Then you start questioning your vendor choices.
More and more, it is common practice to do a vendor analysis to choose the best one, but it is a long process that needs to be done correctly in order not to fall into the same error again. New companies are emerging to do what Gartner does, but many make the vendors look like they are part of an App Store. Now you see stars, feedback, and comparisons. But all is part of the decision-making of having a new vendor. Would I recommend it? Totally. A few weeks or months of serious research will save you money and frustration in the long term.
But how do you choose a vendor or product in a way that you don’t get bound forever in the case it goes awry with them, or the product ends up not fitting your needs or budget? Most contracts have safety clauses that protect them from an unhappy customer. And this is understandable for big providers that depend on third parties to accommodate your needs, or their financial forecast depends on the length of the contracts. Two examples are Splunk and Akamai. When you purchase their services, they need to allocate infrastructure to support the services they will offer you. Either in the form of compute power or resources in a cloud provider that they purchased in advance for a long term, which will provide them with a better price, or an infrastructure that needs to be prepared to handle that extra traffic. If you opt to end the contract, they are still bound by their own contracts and infrastructure that was set up for you, and in some cases, cannot be returned without them paying the fines. Some vendors have their own infrastructure like Akamai, some sub-contract like Splunk. There is not a Costco for Technology, where you can return your goods anytime because you don’t want them anymore. Most vendors work like Wayfair’s restocking fees. But there are also vendors willing to keep a door open and accept that you don’t want to work with them anymore. There are even vendors that are willing to buy your contract from another vendor just to get you as their customer. These cases are very rare, but definitively possible if you play smart when signing the contract. All contracts are not the same. You, the customer, have the power to put clauses that protect you from landing in an expensive limbo. If the vendor is willing to have you in their deck of customers, it will work with you.
The Product’s Quilt. Past and Future Acquisitions.
Now let’s go back to choosing the product. In the current age of technology, only a few vendors are the creators of their battery of services. Instead, many have acquired companies to expand their portfolio. This is a normal way to offer an established product for a niche, without having to develop it from scratch. These vendors will go through all types of tribulations to blend the acquisition into their product to make it look like it is part of an entire ecosystem. Some are just an amalgamation of links, UIs, and redirects that look more like a preschooler’s macaroni and glue card. Pretty much like a quilt of products.
Some examples are vendors like Palo Alto that have acquired companies like Bridgecrew, Twistlock, and Redlock to grow their Prisma Cloud product. Others like Tenable acquired vendors like Ermetic to expand their Cloud Security portfolio. Palo Alto’s still looks like a quilt, with many features still depending on the old infrastructure of the acquisition. Tenable’s is better integrated, but still, you can see the redirect when you click the Cloud Security link.
Acquisitions that have already been integrated are not a problem when you are analyzing a vendor, but are an important negotiation point if you can get insights into future ones.
Aquisitions the other way
Something else that can happen is that your current vendor is acquired by another big company. The case of Carbon Black that got acquired by VMware, to then get acquired by Broadcom, the company that acquired Symantec. When these types of acquisitions happen, the products tend to change, and how the services are rendered to end users. Not always do acquisitions end up with the same customer service you used to have. This is something I’ve heard from colleagues that are going through the Carbon Black acquisition, for example. Sometimes they make sense, like Broadcom acquired by Palo Alto. It expands its Cloud Security portfolio. But Carbon Black is just another product in the big pile of products under Broadcom. There is no cohesion of the functionalities, and the products are still separate but under an umbrella. I remember a phrase that says “the one that holds too much never does it strong”. When your portfolio is too big, it’s hard keeping everything in order. There is no difference if the company is small (Broadcom) or big (VMWare). There is nothing that can tell you that your vendor is not going to be acquired by a bigger conglomerate. Just be sure that when it happens, your products and services are going to be the same until the end of the contract with no changes to the product or the services. Also, be sure that when the contract gets renewed, or is about to be renewed, no surprises will come up like price hikes, or changes in SLAs, services, or contacts.
Get Mauricio Giraldo’s stories in your inbox
Join Medium for free to get updates from this writer.
Customizable Vendors
It’s okay not to pick the “best one” in the market. Vendor selection is a hard process that needs to be viewed from the inside of your company, and not from the perspective of the vendor itself. Every company has created a product to fit the most markets, but that doesn’t mean that their product is exactly what your company needs now or in the long term. Your company is unique, and the same are your needs. Yes, these needs will change, and you need a vendor that can reshape to them. But you definitively don’t need to pay for an “included” service you won’t use. Many vendors offer their services like plug-ins, that you can turn on and off based on how much you want to pay. For example, Checkmarx SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) are options you can purchase together or separately. Qualys has also a big portfolio of services that you can turn on or off based on what you need. But others offer you a set of services that are part of the product and you may have them already and you will not use them. For example, SentinelOne’s inventory. If you are a company that already has an asset discovery product, for example, like LanSweeper, this is a service you may not need. But what happens when you need to renew your LanSweeper contract, and now you know a similar functionality is part of your SentinelOne contract? You may think: let’s ditch the LanSweeper contract and stay with SentinelOne. This is a typical vendor strategy. Ditch another vendor to stay with a more complete provider. This can be looked at as a budget advantage, because you can tell the business that you are bringing money back to the pot by removing a vendor. But a hidden consequence is that now you are “vendor locked in”. You now depend on one single vendor for multiple services and you wish either they will be nice with you and your budget as long as they are your providers, or that they don’t go belly up in the future leaving you with more problems. Hewlett-Packard used to have a clause when contracting third parties: the third party cannot depend on HP on more than 40% of their total revenue. That means that if Hewlett-Packard cancels your contract, you won’t be in a financial burden. The same concept should be applied when you have a vendor. Not putting all your eggs in one basket, because if the basket breaks, all your eggs break. If the vendor gets acquired, or goes bankrupt, or the prices skyrocket, you will be the one, again, considering your life choices. Your vendor needs to provide only a subset of your needs, not necessarily everything. And those needs are something you can turn on or off as you wish. In PaloAlto credit system, you can choose where to spend your montly usage. Same with Tenable. In Tenable you can choose to use WAS (Web Application Scanner) or not.
Diversify your providers
The opposite can be seen when companies choose to have a diversified technology third-party. For example, using DataDog for telemetry and Splunk for security, Checkmarx for SAST, and Qualys for DAST, Cloudflare for SASE, and SentinelOne for EDR. The vendors I just mentioned provide the same complementary products and can be used for both functions, but you are not tied to a single one.
What about implementation?
OK, let’s assume you have chosen your potential vendors for a service you want to get. You already diversified the needs, checked the contracts, and maybe done some presentations or even POCs (Proof of Concept). Now you can be at the verge of two things: you need to implement the product from scratch because you don’t have it, or you need to replace your current one.
Let’s say you are replacing your EDR solutions with a new one. You already have deployed hundreds, if not thousands, of agents in your network. Now you have to uninstall them, install new ones, create new policies based on the new tool, and finally pray for the application not to block all your devices (EDR systems have a learning mode that doesn’t interfere with the devices while it learns and creates a baseline of your environment). There will be a time where your EDR solutions will overlap, maybe another time where some devices will be unprotected, and a time some devices won’t work. Also, a time where the devices will have partial protection because the new application policies differ from the old ones, and the transition to the new ones will imply a limbo of protection. All I mentioned is perfectly normal, is expected, and is not the vendor’s fault. It is just how it is. Now, how the vendor will have a system to make this transition easier, or a deployment technology that is easy and can be deployed with little to no friction, is something you need to consider too. This can be in the form of a dedicated team that will help you along the way, or an infrastructure that has all the needed parts to make it work (Cloud Formation templates, Terraform scripts, Terraform scripts, etc).
Final Thoughts
This leads to a list of things to consider when getting a product, because maybe the one that seems to be the shinier (like the ones in the right and topmost quadrant in Gartner, or the ones with the more stars in Capterra), not necessarily is the one you need:
- Looks like the needs of a product are from inside your company. A vendor will try to work as a patch to your gaps. But some patches may cover things that you already have. Don’t end up with redundant services. Looking from inside means that you check what you have, check what vendors offer that service, and choose the one where you end up with less redundancy.
- Don’t believe all the vendor says. Always question the minimal things, always ask for the reach of the service. Many times they mention things that the product does, and many times some of them are either premium services or require the purchase of something else.
- Question a vendor if they trash others. A vendor that talks badly about another one can mean that something else may be happening, or happened. In my years of experience, I saw sales people trashing the competition, and it was because there was a lawsuit involved, or they lost a big contract against them. Many vendors offer the same, and they will work with your company. It is the little things like implementation, or live support that can make the difference.
- Look for the product that will impact you the least. An implementation that slows down your workforce ends up costing more. Look for companies that offer professional services in the contract that can be used for implementation. Also, look for companies that include training as part of the contract to speed up the knowledge gap of owning a new product. These things must be part of the contract, not an add-on you have to pay extra for like a premium.
