How to run a security vendor evaluation in 30 days

Most evaluations fail before they start: no written problem, a shortlist inherited from a peer, and a demo calendar that vendors control. This plan fixes the sequence.

Week 1: write the problem, not the wish list

Write one page. What is broken today, what it costs (hours, incidents, audit findings), and what "fixed" looks like in twelve months. Then list five must-haves and five nice-to-haves. If you cannot rank a requirement, it is not a requirement.

Decide the evaluation team: one owner, one engineer who will run the product, one person from procurement or finance, and one sceptic. Give everyone the one-pager.

Build the scorecard now, before any demo. Use the five DBSE axes as the backbone: deployment effort, support quality, features versus promises, pricing transparency, return on investment. Add your must-haves as pass/fail gates.

Week 2: shortlist on evidence

Start from the vendor directory and reviews filtered to your organisation size and industry. Read the cons first. Ask in the Vendor selection forum which products people replaced and why.

Cut to three vendors. Send each the same written questions and the same dataset or environment description. Refuse the "discovery call" that precedes the demo; you have already done the discovery.

Week 3: proof, not demo

Every vendor gets the same scripted proof of concept: your data, your alerts, your identity provider, your ticketing tool. Score it live on the scorecard. Record who from the vendor touched the environment and how many hours your engineer spent; that number is the first draft of deployment effort.

Run two reference calls per vendor, with customers you pick from the review pool, not the vendor's list. Use the reference-call script.

Week 4: price the whole thing and decide

Run each finalist through the TCO calculator with the internal hours from week 3. Ask each vendor for a three-year price with the renewal uplift written into the order form. Silence on uplift is a data point for pricing transparency.

Hold a one-hour decision meeting. The owner presents the scorecard; the sceptic argues for the second choice. Decide, write down why, and publish the decision internally with the scorecard attached.

Then come back and write the review in six months. That is how the next team saves their thirty days.