Stage 5: Run a compact, comparable procurement

Planning allowance: 2–4 weeks; 12–24 hours. Send the same scope sheet and scenario to a small set of plausible providers. Ask for exceptions in a dedicated column and request a delivery-team discussion, not only a sales demonstration.

Ask each bidder for a sanitized incident case, onboarding plan, reporting sample, supported integrations, response permissions, service terms and full quote. Request a reference from an organization with similar operational constraints, subject to that customer's consent. Record what a reference can establish and what remains untested.

Normalize price by your actual quantities. Keep service, software, consumption and optional work separate. Avoid converting all offers to “per endpoint” if one includes identity and cloud investigation and another does not.

Exit criterion: an evidence-backed shortlist and a register of contractual exceptions. Pitfall: scoring a promised future integration as a currently usable capability.