Does any security engineering team get excited when they hear "we're rolling out Defender"?
No. Not one.
What they don't see is Microsoft threw it in. It was a $600,000 line item in the comparison. The CISO doesn't have to spend that $600,000. Then the CFO calls: sales missed the number, they're threatening to cut the budget. Save the 600 so you can still do the thing you actually wanted with the 300 you have left.
That is a vendor selection. It looks like idiocy from the floor. It is arithmetic plus political capital from the chair.
If you are going to grow into that chair - or sit in it now - this is how those decisions actually get made. It does not mean they are all good. It means they are not random.
The bake-off is the last 10%. Everything below is the rest.
Know yourself before you know the market
Best of breed is a slide. Best of wallet is the job.
You are not picking the "best" FIM, EDR, or AI SOC in the abstract. You are picking the thing your wallet, your board, and your remaining political capital can survive.
Eighty-six vendors in a category collapse without a briefing if you start here: what would actually be good for us. Then you might have ten. Then three you will talk to and POC. If you skip that, you take someone else's "best of breed," run twenty-five conversations that are a waste, and two of the three you POC get acquired mid-cycle. That is the AI SOC story. It is every crowded category.
Salesforce is a fine CRM. It is also a monster with a setup tax built for a company you are not. Knocking it off the list is not ignorance. It is best of wallet.
The Magic Quadrant is a tool for presenting a decision you already made. It is not how you start. Unwritten MQ rules - market cap, "too big to be acquired" - died with a $70B check. Financials in a quadrant are not safety.
The chair is not the floor
At senior director the job stops being labor output. You are competing with every other C-level for investment, and you will be graded on fiscal accuracy whether anyone said so.
The CISO is often the most hated person in the boardroom if they are even invited. The board's job is a healthy business and enriched shareholders. Cyber looks like insurance they didn't ask to buy - sometimes it looks like blackmail. Every slide is numbers that don't parse. "I thought we were better than last time." "There are seventy-three new attacks we also have to consider." They have no patience for the catalog. They are not villains. They cannot draw a straight line from an enormous security spend to more money, more survivability, more shareholder value. And security is always asking for more.
You do not have the political capital to fight seventy-three things. You can fight three.
If you open the door and say "here are seventy-three, pick your top three," two things happen. The stakeholders will not agree. Your three and theirs may have nothing to do with each other. And the number-one thing you were going to lose anyway still loses.
So you pick the three you can win, and you spend the rest of the capital keeping the lights on. The team hates a selection because they never sat the audit committee, never heard the board member, never sat CIO staff. Those variables do not travel downstairs unless you walk them down.
That is the communication failure, not the selection. Reddit will bury you for saying so. Say it in the room anyway.
You buy trust
I buy trust. I don't buy anything else.
Capability is table stakes. If you do not trust them on a Tuesday after the sales engineer leaves, you are renting a demo.
Find someone who wants you. Two-way fit, not a scorecard. If they are waiting for a bigger logo, you are the waiting room. A garage with a sharp ICP can want you more than a platform that is parking you until enterprise shows up.
The story that more people repeat often wins. Best product rarely does. That is not a reason to pick the loud one. It is a reason to know you are fighting a story, not a feature matrix.
Already on the sheet beats already better
MSA signed. Security review done. Approved-vendor list. Renewal cycle. On the books.
A net-new vendor is a new MSA, a new review, a new line item nobody budgeted. In cyber the procurement cycle is often longer than the sales cycle.
Expanding the thing already in the building is a different decision than "the other logo is nicer." Rubrik can be nicer. Rubrik still has to walk the gauntlet Commvault already finished. Price that, or you are lying to yourself about switching cost.
If the operating model only works while they are in the building, you borrowed forever and called it a buy. Vendor-shaped process is a red flag.
The J-curve
The first financial question is not "does this product work." It is: is your adoption curve better for my organization than the other guy's.
Any change dips before it pays. You run two things in parallel. Productivity takes a hit. Training, implementation, migration, new SOPs, transition risk. That dip is the J-curve. The executive is expected to absorb all of it.
If a vendor says they will save you 20%, ask them to cut you a check for the 20%. They will not. So there is a J-curve. If they cannot explain when the curve ends - and why you will not be back in this room in twelve months making the same decision - the curve is just a cost.
The floor most CISOs actually use: 20/20. Twenty percent better, twenty percent cheaper. That is the minimum to justify crossing. A 9% modeled reduction, or 0.6% on a big exposure number, is a rounding error on a J-curve. No CFO signs that.
Green money is new budget. Brown money is money you already spend that you can stop. Displacement you can prove is brown. A slide that says "efficiency" without naming the twelve tools that go away is a wish.
One for the business, one for me. The business wants to cut costs. The person in the chair wants to accomplish the thing the CEO told them to do, and to look like a hero doing it. Pitch only the company ROI and you miss half the decision. Green money still needs both: make me a hero, and improve the business. Neither alone.
- What do I run in parallel, and for how long?
- Who takes the productivity hit, and is that my team or yours?
- When does the curve end, in a date I can put on a slide?
- Is this green money or brown money?
- If you save me 20%, do you cut me a check - or am I funding the dip?
- What's the ROM. Ballpark. Now. "It depends" with no range is hiding price or wasting the hour. Easy no.
If they cannot answer those, they have not considered reality. You already know how the POC ends.
Money the floor never sees
Iron budget. You will not fund another exec's win. If Finance saves the FTEs, Finance pays. "Split it with HR" is politically toxic. Easy no.
Headcount is power. Never buy a story that "replaces 10 FTEs." You automate to redeploy and absorb more demand, then argue for more heads. A vendor who pitches shrinkage is attacking the chair.
Do not split the cost. Asking IT and Finance to share is asking you to negotiate with a peer. Easy no.
Quick-transaction tell. Generic pitch, aggressive close, no discovery. They want commission, not the install. Easy no.
Cyber has no ROI. It is insurance. The board question is not "will we be hacked." It is "how bad when we are." FUD makes CISOs angry. "Your competitors bought this" does not move the chair. What does: framework scores the board can see, insurance dollars only with the insurer on the record, obvious gaps, smaller blast radius.
The $600,000 line
When a platform vendor throws the capability in, the comparison is no longer "is Defender the tool my engineers want." The comparison is "do I spend $600,000 I no longer have."
That is brown money you didn't have to find. It still has a J-curve - engineers will hate it, the dip is political not technical - but the wallet math is the decision. If the CFO is already on the phone about a missed number, that line item is the whole conversation. Tell the floor the $600,000 and the cut. Don't tell them they're wrong for not being excited.
If you cannot say the money out loud, the selection will look like you got rolled by Microsoft. You didn't. You got rolled by the P&L. Those are different stories. Only one of them is true.
Tuesday, not Day 1
Day 1 is ship. Tuesday is maintain at business pace and support the people who have to use it.
Most shops cannot. Copilot gets you a first version. It does not get you change control, the help desk, or the person who still works here in six months.
Ask: can our people run this - understand it, solve it, support it. Integration with what is already in the building (SAP, Salesforce, M365, ServiceNow) is not a nice-to-have. Skill of the team you actually have is a constraint, not an insult.
Build, buy, or borrow. Borrow means sit with your people, train them to take it, stay the pinch hitter. Not staff-aug forever. If the vendor's process is the only process, you did not buy a product. You rented a department.
Pilots without a production date are theater. Too expensive. Set the production target before the POC.
Every AI vendor pick is also sovereignty - where the data lives, what you cannot leave. Most CISOs are not pricing that yet. Price it.
Startup math
Two of the three you POC will get acquired mid-cycle if you picked a crowded baby category. That is not bad luck. That is the default.
- Runway vs your cycle. If their cash dies before your procurement finishes, you are buying a press release. Ask months of runway, not "we're raising."
- Who writes the check after the round. If the next round is the product plan, they have not considered reality. You will be the use case in the deck.
- Concentration. If two logos are the revenue, you are not a customer. You are a hostage.
- Displacement they can name. If they cannot say which twelve tools go away, they are adding a thirteenth. Your J-curve just got worse.
- Who owns support on a Tuesday in six months. Founder-led everything is fine at fifteen people. It is not a vendor. Borrow is a real answer. "We'll hire" is not.
Mature does not mean old. Mature means they can survive your buying cycle, your parallel run, and your incident without you becoming their Series B.
A garage with a sharp ICP and honest math can beat a platform that is waiting for someone bigger. A garage that sells "we do everything" and cannot explain the dip is not a vendor. It is a science fair.
The buddy
How often does the CEO, CTO, or CIO have a buddy?
Every time they hear about a problem.
Sometimes the buddy is the person whose hands are on the revenue engine - DevOps, product, the channel that prints money. The CTO is protecting that time. Fair. Ask: how does looking at this thing improve what your people do?
Sometimes it is not even that. A friend just became chief product officer at a company that has nothing to do with the CTO's job. It is a member of the network.
You still evaluate it.
Treat it like an internal referral for a role. They get on the list. You interview. Then you close the loop: not a fit, here are the four reasons. You do not let them pick. You do not give them undue influence.
Ghosting an internal referral is the worst version of this. Same for the buddy vendor. Evaluate. Close the loop. Then buy what the wallet, the J-curve, and the three fights allow.
Say the name they already trust
A FIM shortlist died in the room until someone said the old open-source name. Banks: "oh yeah, we use that, no problem." The product had rebranded. The CISO had not said so.
Provenance is part of selection. If the thing on the paper is the thing they already run under a different label, say that in the first sentence. Resistance is often identity, not capability.
If you are the vendor
You are not selling to reality. You are selling to a perception.
Build a platform with broad appeal. Sell it narrowly.
If they hear "two people in a garage," they need to hear they are important and they fit the TAM. If they hear they are the waiting room until someone bigger shows up, they leave.
Even if the product is equally good in every industry, pick: $25 million to $150 million, these geos, these markets. You cannot staff "everyone." Four hundred thousand enterprises is not a list. Fifteen thousand, with language that sounds like you meant them, is a motion. In five years that list can change. Fine.
Explain your J-curve before they ask. Give a ROM before they ask. Do not pitch FTE shrinkage. Do not split their budget with a peer. Do not FUD. If you cannot, they will invent the story, and yours will lose.
What to do Monday
- Write the wallet before the long list. Size, what a wrong buy would actually hurt, what you will not spend even if the MQ loves it.
- Ask who is already on the sheet. Expanding them is a different decision than a net-new logo.
- Cut to ten without a briefing. Cut to three you will POC. Time-box the rest. No POC without a production date.
- ROM now, or they are off the list. "It depends" is a no.
- For each of the three, write the J-curve: parallel run, who takes the hit, when it ends, green or brown, 20/20 or not.
- Run startup math on anyone without a balance sheet you already trust. Runway vs your cycle. Concentration. Named displacement. Tuesday support.
- Kill anything that funds another exec, splits cost with a peer, or sells FTE shrinkage.
- For each of the three, write the sentence the floor will hate - the $600k, the three fights, the buddy - before you announce the pick. If you cannot say it, you are not ready to pick.
- Buddy vendors go on the list. They get a real eval and a closed loop. They do not get the win unless they earn it.
- Say the old name if there is one. Price sovereignty if it is AI.
- You can fight three. Pick them. Do not run a vote on seventy-three.
This is guidance, not a Gartner PDF. Categories change. The chair does not. The curve still dips. You still buy trust.