4.4: Real Vendor or Paper Vendor

Real Vendor or Paper Vendor

A paper vendor is a company whose product is its marketing. Real detection engineering, real analysts, real operations exist somewhere in the industry — the paper vendor resells, white-labels, or automates a thin version of them and sells it with the same vocabulary. From the deck, the two are indistinguishable. This matters most in exactly the category you’re most likely to buy first: managed detection and response, where you are purchasing judgment exercised by people you’ll never meet.

You can’t out-expertise their sales engineers. Instead, ask questions where the shape of the answer is the signal — questions a real operation answers easily and a paper one answers vaguely.

Questions that can’t be faked

“Show me a redacted example of the actual alert you’d send me at 3 AM.” The single highest-signal ask. A real MDR shows you a specific artifact: what they observed, why it matters, what they already did, what they need from you. A paper vendor shows you a dashboard screenshot. If the sample alert says “suspicious activity detected — please investigate,” you have just been told, precisely, what you’d be paying for.

“Who investigates — how many analysts, what time zones, what’s their median tenure?” You’re buying a team. Real operations know these numbers because they manage them. Evasive answers (“we have a global SOC”) usually mean a thin overnight bench or subcontracted tier one — which is where your 3 AM incident will land.

“What did your last serious miss change in your operation?” Every vendor with real customers has missed something. A real one tells you a sanitized story ending in a concrete process change — the vendor’s version of the postmortem discipline from lesson 1.7. A paper vendor tells you they haven’t had one. That answer alone should end the meeting.

“What’s your median time from alert to human triage — and how is it measured?” Not “SLA.” Measured actuals. And watch whether the clock they describe starts at detection or at ticket creation; paper vendors start clocks late.

“Give me two reference customers my size — including one that left.” Everyone has happy references. A vendor confident in its operation will let you talk to a churned customer or at least tell you honestly why customers leave. Refusal isn’t disqualifying, but it’s a data point — and the why customers leave answer is often the most honest thing said in the entire sales process.

The contract is part of the evaluation

The questions above tell you who they are. The contract determines what being wrong costs you. Four terms worth negotiating on any significant security purchase:

• A pilot with success criteria you define. Thirty to sixty days on your real telemetry, with the noisiest systems included. Defined up front: what alert quality, what response time, what noise rate counts as passing. Vendors that resist pilots on their own product’s effectiveness are telling you something.
• Termination for convenience, even with a penalty. The option to leave at 90 days’ notice changes every conversation you’ll have with the vendor for years — including the ones in the next lesson’s scenario.
• Service-level terms about quality, not just uptime. An MDR that’s up 100% of the time and sends you noise is meeting a standard uptime SLA perfectly. Put triage-time and escalation-criteria commitments in writing.
• Breach notification and data return. They notify you within a defined window if they are compromised (72 hours is a common ask); your data comes back in a usable format at exit. Lesson 1.6 called these the contract terms whose value shows up when something breaks. Now you’re the one writing them in.

The tell that summarizes all of it

Real vendors talk about their failures, their process, and their people, because that’s what they actually operate. Paper vendors talk about their certifications, their AI, and your fear. When every answer routes back to the deck, believe the routing.

Next: a year inside an MDR contract, decision by decision.