The 40-question vendor evaluation checklist

Copy this into your evaluation document. A blank answer is an answer.

Deployment

1. What does a full deployment take in calendar weeks for an organisation our size, and who did the last three?
2. Which parts require professional services, and what do they cost?
3. What must change in our environment before the product works (agents, network, identity, log sources)?
4. What breaks when the agent or connector is misconfigured, and how do we know?
5. Can we deploy in stages and roll back?
6. What is the upgrade cadence, and who performs upgrades?
7. Which of our existing tools does it replace outright, and which does it merely overlap?
8. Show the exact integration with our ticketing, identity, and SIEM, not a slide of logos.

Operations

9. How many alerts per thousand endpoints per day does a tuned deployment produce?
10. Who tunes it, and how long until the tuning is done?
11. What internal hours per week does a customer like us spend running it?
12. What is the documented process when the product itself has an outage?
13. Which telemetry leaves our environment, where is it stored, and for how long?
14. Can we export our data in full at the end of the contract?
15. Is there an API for everything the UI does?
16. What are the browser, OS, and version requirements, including the ones you are about to drop?

Support

17. Where is support located, in which time zones, and what is the response SLA for severity one?
18. Do we get a named technical contact, and what does that cost?
19. Show the last twelve months of published incidents and root-cause reports.
20. What is the escalation path when support says "working as designed"?
21. Who owns the product roadmap decisions, and how do customers influence them?

Features versus promises

22. Which capabilities in the demo are generally available today, which are in beta, and which are roadmap?
23. Which of our must-haves require a higher tier or an add-on?
24. Name three things the product does not do that competitors do.
25. Which features were removed or deprecated in the last two years?
26. What has the product's detection or accuracy record been in independent tests, and which tests were declined?

Pricing

27. What is the unit of pricing, and what counts as a unit (an endpoint, a user, a GB, an identity)?
28. What is the three-year price with the renewal uplift written into the order form?
29. What triggers overage, and how is it billed?
30. Which add-ons do most customers end up buying in year two?
31. What happens to price if we shrink?
32. Is there a price for a co-terminated, shorter first year?
33. What discounts are conditional on reference calls, case studies, or logo use?

Vendor

34. Who owns the company, and what changed in the last eighteen months (funding, acquisition, layoffs)?
35. What is the churn rate for customers of our size?
36. Which customers of our size and industry can we call without the vendor on the line?
37. What certifications does the vendor hold, and which audits can we see under NDA?
38. How does the vendor handle a vulnerability in its own product, and what was the last one?
39. What is the data residency option for India, and is it in the contract?
40. What is the exit plan: notice period, data return, deletion certificate?