The logical song

To say that the security vendor marketplace is crowded would be an understatement. For any problem a security team faces that can be aided with technology, look no farther than a conference expo floor and you’re sure to find (at least) dozens of self-proclaimed solutions in any given category. Conferences are perfect opportunities for vendors to get in front of large numbers of potential buyers and tell their story. For the buyer, though, this dizzying array of options can be overwhelming, especially amidst the flurry of concurrently broadcasted booth presentations, personal introductions, swag handouts, and ever-eager booth staff. How can a security technology buyer or evaluator cut through the marketing hype and determine what’s right for his or her company’s environment?

Three security officers share their strategies for navigating expo halls and coming out the other side with a purchasing roadmap.

There are times when all the world’s asleep

Walking a tradeshow floor full of promising security vendors can be like drinking from a firehose, and security buyers would be wise to consider conferences as a “tasting menu,” or a first-time opportunity to sample a little bit of everything before committing to one big, expensive meal during a second visit. With that in mind, Chris Ensey, Chief Operating Officer at Dunbar Armored, says, “The trick is to come prepared. If you know exactly what you want going into a conference, you can avoid the trap of getting lost in the froth of the event.” To start this process, Jim Routh, Chief Security Officer at Aetna Global Security, offers some practical advice. Routh says that anyone considering a technology purchase should sit down ahead of the event and “make a list of the categories of technologies or security controls of interest” and use that as a shopping list of sorts. Before the dazzle of fancy demos and colorful brochures, hone in on the features and capabilities actually required to improve your company’s security program. It’s easy to get caught up in the expo hall enthusiasm; keeping your thoughtfully prepared list close at hand—and sticking to it—will maintain focus on your/your company’s needs, discouraging distraction.

Jaret Preston, Information Security Officer at Caterpillar, Inc., furthers this idea: “Do your research away from the environment. Utilize [vendors’] material, websites, and other resources to truly cut out the ‘noise.’” Preston adds that it is beneficial to go in armed with “specific questions, needs, and desires” that will help you extract the right information from the provider during your visit. Doing so will help you keep your contact centered on what you want to know instead of hyping his/her company’s latest and greatest product features and functionalities. If learning the latest and greatest is on your to-do list, by all means, take the time to talk about those items. If not, spend a moment before you step foot on the floor to plan what does need to be covered.

ISW Show FloorThe questions run too deep

Speaking of “off the floor,” Ensey recommends that potential buyers, “arrange to meet specific vendors off the show floor. Grab coffee nearby the event, or just pull them aside to have a one to one chat.” Physically moving away from the show floor and into a quieter, calmer location means attention can be concentrated on the questions you need answered. Booth space can be a great form of entertainment, but if your goals are information collection and proof of concept, opt for a setting more catered to those goals.

Even outside of the expo hall, the conference meet-and-greet is just the tip of the iceberg. Very few security buyers will make a final decision—or even be able to collect enough needs-specific information—from that experience. Preston advises potential buyers to “focus on making contacts” during the event; “match a name with a face and understand the best ways of contacting them” after the conference ends. It’s always better and easier to do business with people you’ve personally met, so use the face-to-face time to cement relationships and build rapport that can be carried into future conversations.

If you have a distinct category of technology under evaluation (e.g., SIEM, log management, threat intelligence, etc.), use onsite time to create or reinforce personal contacts and schedule follow-up appointments or meetings with the companies that stand out. Create a short list of viable candidates and then, “schedule proof of concept projects with a handful of potential partners” following the event, recommends Routh. You’ll want to see these vendor tools in action, but a show floor is not the best place for a proof of concept; they’re too busy, too noisy, and too distracting. Use the event to initiate or strengthen relationships then schedule follow-on activities that move you towards your purchasing decision.

In addition to proof of concept trials, Routh suggests that evaluators contact venture capital (VC) firms about any backed companies on your short list. Because VCs already have a financial stake in the company, you can bet they’ve done their homework and can offer a perspective on why the firm bought in (literally and figuratively) —true benefits, differentiators, and market opportunities. VCs are not big on “marketing buzz” and buyers can learn a great deal by tapping into that resource if it’s available.

Won’t you please, please tell me what we’ve learned?

When an independent lens isn’t available, Ensey says his “best rule of thumb is to push vendors to provide a list of competitors in the space.” Doing so requires vendors to classify what they do and provide points of comparison. In other words, he adds, “If you can get them to name a short list of contemporaries, you can draw out what they do, and more importantly, what they do NOT do.” It’s often challenging for buyers to wade through marketing speak and finely-tuned sales tactics to uncover a product’s true capabilities; how many times have you heard a vendor sales representative say something along the lines of, “We don’t have any real competitors. We’re creating a new category”? Pressing the vendor into comparisons does not mean you don’t believe they offer unique capabilities; it just means that they, themselves, have to use less jargon to explain what they do and how they do it. Among the tchotchkes and music and masses of people at a conference it’s easy to get caught up in the frenzy. Rein in the excitement by asking specific, pointed questions that contribute to a productive conversation. “Once you have covered what you came for,” says Ensey, “then you can go back and pick up a few souvenirs.”

In addition, when meeting in a public place—conference show floor or coffee shop—Preston reminds evaluators to avoid over communication when it comes to the confidentiality of your company and its processes. A new tool might be part of an upcoming initiative or acquisition that’s not yet (or never will be) for public consumption. Especially when you can’t control your surroundings, consider what information you can and can’t communicate in discussions with the vendor without an executed non-disclosure/confidentiality agreement.

I know it sounds absurd

Vendors use participation in conference expos to bulk up lead lists and actively engage even the most mildly interested security buyer. It therefore stands to reason that onsite representatives will pull out all the stops to impress anyone who visits their booth. It’s easy to get caught up in the rush and energy that accompany an expo hall, but it’s significantly more productive—if you’re an active buyer—to stake out your destinations and arrive armed and ready with specific questions and goals in mind. Give vendors the opportunity to dazzle you, but make sure they’re dazzling with the right information. Oftentimes sales and marketing teams are given an agenda for the event: talk about a new product or feature, complete X number of demos, scan every visitor to the booth who asks for a t-shirt. As a buyer, your goals are different, and if you stick to your agenda, if your questions are addressed adequately, you’ll advance your buying cycle. That will ultimately make everyone involved happy.