I’m seeing teams auto‑renew big platform bundles without mapping features to their top three risks, and it’s burning both budget and attention. Last week I cut a client’s $58k EDR/identity renewal by scoping to two use cases and a 90‑day pilot tied to phishing and lateral movement metrics. How are you customizing purchases to your risk register instead of letting vendor SKUs dictate the program?
We make every renewal pass a “no SKU without a use case” check tied to two MITRE ATT&CK techniques we’ve seen, then run a 60–90 day PoV with success criteria (e.g., time-to-detect for T1566 and T1021) and an exit clause; link for context: https://attack.mitre.org. Small caveat: bundles can still pencil out if they collapse agents and support, but only after the PoV proves it moves those two risk metrics — otherwise it’s buying the whole toolbox when you just need a screwdriver.
I use ‘no runbook, no renewal’; pager noise must drop 20%. During major incidents, we pause pilots.
Quick example: we added a procurement gate — “no risk ID, no PO” — so every renewal line item must point to a register entry (Jira) and show last‑quarter movement on that metric; if not, we cut to a minimal tier or a 90‑day ramp. Small caveat: during an active incident we’ll extend terms a month to avoid churn, but only with a written exit plan.
Your $58k EDR/identity example tracks — I make vendors give a 14‑day export of detections mapped to our “top three risks” and quote price per signal‑handled; if noise is >3:1, we cut features and add a flex‑down rider for quarterly seat drops… , only caveat: during audit/IR weeks we skip PoVs and use a month‑to‑month bridge. Anyone tying service credits to time‑to‑contain for lateral movement?
Quick example: we build a quarterly capability heatmap from postmortems and tie each SKU to a single gap and a target delta on MTTD/MTTR; vendors have to show the delta in our own telemetry replay before we sign. My only exception is compliance-only controls where I’ll accept “control coverage” as the metric, but we still insist on an off-ramp clause. If it isn’t reducing analyst hours, it’s gym equipment turned coat rack.