Cybersecurity buying research| Criterion | Weight | Good looks like | Bad looks like | How to score and verify |
|---|---|---|---|---|
| 1. Business and scope fit | 15 | Critical processes, populations and exclusions are explicit | Generic package with unclear boundaries | Compare against the signed buying brief; inspect every mandatory scope row |
| 2. Telemetry and integration coverage | 15 | Required sources, license dependencies and data-health monitoring demonstrated | Integration logos with no source-level evidence | Request source inventory, ingestion test and missing-data handling |
| 3. Response authority and overnight operation | 15 | Investigative steps, allowed actions and backup approvals are usable | Fast notification but no clear action path | Run a scenario with an unavailable primary contact |
| 4. Investigation and detection quality | 10 | Analyst reasoning, evidence and closure quality can be examined | Alert forwarding presented as full investigation | Inspect sanitized cases and a representative validation exercise |
| 5. Customer workload and service management | 10 | Named owners, clear hand-offs, useful reporting and accepted internal workload | “Fully managed” with unowned remediation | Review task matrix, sample review and internal capacity |
| 6. Incident and recovery hand-offs | 10 | Forensic, remediation and recovery boundaries are explicit and rehearsable | Recovery assumed but outside every party's scope | Walk through an incident-to-restore case with the business owner |
| 7. Total cost and commercial clarity | 10 | Like-for-like annual and three-year costs with assumptions and exclusions | Low headline fee with unknown usage or optional charges | Reconcile quote, terms and workbook; test a buyer-defined growth case |
| 8. Access, data and assurance | 5 | Least-necessary access, useful assurance scope and explicit retention/export | Broad access or badges without relevant scope | Review permissions, assurance report and data lifecycle |
| 9. Onboarding and acceptance | 5 | Named tasks, dependencies, realistic milestones and buyer acceptance | “Live” declared before sources and routing work | Inspect plan and require a written acceptance checklist |
| 10. Exit and continuity | 5 | Export, revocation, knowledge transfer and transition ownership defined | Lock-in, unclear deletion or inaccessible evidence | Walk through an orderly exit and provider-unavailability scenario |
| Total | 100 |
Weighted points = criterion weight × rating ÷ 4.
Add all ten weighted values for a total from 0 to 100. Keep at least two decimal places during calculation. Unknowns earn zero provisionally, are marked clearly, and may be rescored after new evidence arrives.
1Business and scope fit 15%2Telemetry and integration coverage 15%3Response authority and overnight operation 15%4Investigation and detection quality 10%5Customer workload and service management 10%6Incident and recovery hand-offs 10%7Total cost and commercial clarity 10%8Access, data and assurance 5%9Onboarding and acceptance 5%10Exit and continuity 5%
Weight total: 100 /100
Working view: explore the first table
Criterion
1. Business and scope fit
- Weight
- 15
- Good looks like
- Critical processes, populations and exclusions are explicit
- Bad looks like
- Generic package with unclear boundaries
- How to score and verify
- Compare against the signed buying brief; inspect every mandatory scope row
Sources cited on this page
No external source is linked directly in this page.
Open the section source register →