How do you compare and negotiate the cost of different vulnerability assessment vendors and services?

Due diligence is another driver for Vulnerability Assessment project. If your largest customer is asking you about the Vulnerability Assessment Tool you use you might benefit from asking them which one they use and whether they want you to use the same one.

You’ve touched on critical aspects like the type, size, and complexity of IT assets, as well as the frequency and depth of scans. To this, consider adding a risk assessment to prioritize your assets based on their criticality to operations.

Comparison and negotiation of the vendor's costs: >Define scope and objectives: identification of key vulnerabilities, compliance reporting, or continuous monitoring. >Issue of RFP. >Compare responses based on cost, service offerings, reputation of the vendor, customer reviews, and the value propositions by different vendors. >Assessing vendor's experience & expertise in performing VA Scanning and reporting tools and technologies used by them. >Validate the certifications, the references, testimonials and reputation of vendor. >Ask for a detailed breakdown of costs. >Negotiate flexible options for the pricing models. >Ask for demos or trials. >Have a satisfied proof of concept. >Have a clear & transparent terms of engagement and SLAs.

Higher-end vulnerability scanners will usually provide better documentation and a higher level of service. Their team may even help you mitigate the vulnerabilities.

What I always like to do when selecting a vendor, regardless of the solution, is to put the list of requirements on a matrix, and rate each vendor based on their capabilities (for example: 0 as do not met, 1 partially met, 2 met). By the end, you will have a score that you can compare against each vendor per pricing. Now, how it should work technically you have an RFP with your list of requirements and vendors reply against those providing a pricing. Most common model is per IP, but depending on add-ons pricing may vary

It's pretty easy to break a service by patching a vulnerability and it isn't always so easy to undo the patch. The provider of the expert service needs to be identified. If you're not going to provide that expertise then the software vendor should or else a 3rd party service provider should. The cost of the offering will change based on who is providing that expertise.

It is important to have within the contract terms that defines deliverables and assumptions. For automated vulnerability scan it's pretty simple as the vendor provides the solution and support (important to define levels of support and what you get back). When you talk about a service provider (that will perform manual tests for example), it's important that you define the following in the contract: - Length of the testing - Scope of test (if you are limiting to a specific environment for example) - Deliverables (reports, presentations, instructions) - Assumptions and terminologies These will avoid misunderstandings from both ends

If possible, you should always do a trial before buying any product. You should wait as long as possible to start the trial and then as do as much as possible with the product within the trial time period. 9 times out of 10 the product will work as advertised and you'll purchase it. 1 time out of 10 it won't. Vendor demos are fine if you're trying to get a quick look at the product but I find them to be completely useless for evaluating a product for suitability or purchase.

Setting up a checklist or scoring system to objectively evaluate the various functionalities and features of the tool. Gauge the tool’s ability to detect false positives and false negatives, as this affects both efficiency and risk. Look for customization options—can the tool adapt to your specific needs and reporting formats? Assess the speed of the scans; a slow tool could disrupt operations. Also, consider post-assessment actions: how easily can the tool’s findings be actioned, and is there an option for automated remediation? And don’t forget to scrutinize the exit strategy—know the process for data removal and service termination in case the tool doesn’t meet expectations or you decide to switch vendors.

Usually when you have a RFP you ask a list of 3 references that vendor provides name and contact info for each. Although they will provide only clients they know it's very satisfied with the services. Agree with Daniel, good if you are able to check on research entities such as Gartner or InfoTech to review technically if they deliver what promises.

You might be able to find something on Reddit or Gartner that is helpful. Reviews aren't very useful because the software companies pay for them. The references that the software company provides will always tell you that it's the greatest product ever. The best option is to talk to your professional network and get a good understanding of the products place in the market and the service you can expect.

Software providers will generally provide different levels of service and different licensing models. Review all of them to select the one that's right for you. It will be possible to upgrade to a higher tier or to add more licenses. It may not be possible to downgrade or reduce licenses. Controlling for cost it's better to underprovision. Long-term contracts (i.e. more than one year) can reduce cost but are very risky.

Some vulnerability scanners are very inexpensive and can be a good way to get started. It's ok to start with the basic vulnerability scanner and get a better understanding of what you value before graduating to the enterprise vulnerability scanner. Try not to overplan. It's ok to buy one license, then 10 and then after using it for a year decide to purchase the 3 year subscription for 1000 licenses. Also be careful with the autorenewals. Once they happen you're going to be stuck for another year.

The best way to compare apples with apples is to put on a matrix. As you define what exactly you are looking for, go to each vendor and categorize what they can deliver and the price. Get the one that is capable of matching most of your requirements, compare price with the second one.