Most firms don't typically include a security vendor's character in their procurement evaluation. But maybe they should.
Most firms don't typically include a security vendor's character in their procurement evaluation. But maybe they should.
Companies spend most of their money on just two things: people and software. And yet we only vet one of those things for character. If people and software are the biggest costs to a business, they’re also the biggest risks.
I’ve spent the last fifteen years in recruitment and people leadership, building teams and assessing candidates in technology companies. I’ve also been responsible for buying the software that handles some of a company’s more sensitive data like HR, IT, and payroll systems.
If you ask me, procurement and recruitment are, in many ways, the same thing.
In both cases, you’re trying to figure out, with relatively little time and information, if a resource (human or software) will either make your business money or save you time, ideally both.
When it comes to hiring, you’re not only assessing whether the person can get the job done, you’re also assessing how they work and who they are as a person. With vendors, you spend 99% of your time on functionality. Character and ethics get a cursory checkbox, usually in the form of a policy document most of the vendor’s employees have never read.
But shouldn’t those things be at least as important to us as a list of features or a list price discount?
The hidden costs of choosing the wrong kind of vendor
And when a vendor behaves badly, you’re the one left dealing with it. The things you were promised in the sales process don’t quite materialise, or support takes weeks to get back to you. Then the contract you thought was watertight turns out to have holes in it (usually discovered when an investor’s lawyers start asking questions in your next funding round). Should a breach happen, the speed and transparency of their response ultimately comes down to leadership integrity.
Technology has reached peak enshittification and buying software from a vendor often means choosing the most tolerable of a few evils. But that shouldn’t be the case.
You should care deeply about who’s behind the technology that approves your mortgage, screens your CV, or decides what your kids see online. You should care way more about who builds the technology that secures all of those things. As Rebekah Wilke put it when we recently chatted on Can’t Hack This, people buying security aren’t really buying a product. They’re buying peace of mind.
It seems almost… quaint to be talking about the role of people in organisations in 2026. Does AI everywhere mean the role of humans matters less in software companies? I’d argue it actually matters more.
Why vendor trust matters more than ever in the AI era
While an agent may write and review the code, it’s humans who decide what that code should optimise for, which trade-offs are acceptable, and which side of the line to lean towards when grey areas loom.
It’s people who decide what to do when things go wrong, how transparent a company really needs to be with its users, and whose interests to side with when there is a conflict between what is profitable and what is ethical.
In short, there is more to making software than producing lines of code. And this gets lost in the AI shuffle.
But how can you tell if the people building the technology are good?
In many ways, how tech CEOs and leaders treat their own team is a good (if imperfect) proxy for how they’ll treat their customers. How they treat their prospects is, in general, a bad proxy: everyone’s on their best behaviour in a sales process. And if they can’t even manage that, run.
You can (and should) ask your prospective vendors more questions about the type of people they are. Assess them like a candidate (because that’s ultimately what they are). A few questions worth asking before you sign your next contract:
How did you react the last time something big went wrong?
When did you last choose a customer’s best interests over your own?
How did you manage your last layoff?
What’s your employee NPS?
Can we meet someone who assessed you but ultimately decided not to buy from you?
Can we try before we commit? (No trial, no deal.)
Why should we trust you?
That last one will get a sales answer. Listen to what they lead with anyway. It tells you what they think matters most. Anyone can build software now. The people that build it is what you’re really buying.
Want to hear from the good guys in cyber?
Check out Can't Hack This, the podcast about the people behind the world's leading cybersecurity teams. Find it wherever you get your podcasts. Latest episode linked below:
