Quick Reality Check — Getting Started Together

• What's the single pain that pushed you to talk with an MDR provider today?
• Who on your team will be most involved in evaluating and onboarding an MDR service? Options: IT Director, CISO/Security Lead, VP Operations, CFO/Finance, IT Manager, Other
• How soon do you realistically expect to make a decision about outsourcing detection and response? Options: Immediately (days), Within 30 days, 30–90 days, 3–6 months, Longer than 6 months
• Would you prefer to start with a lightweight proof-of-value or move straight to a full onboarding? Options: 30-day PoV first, Short pilot (7–14 days), Skip PoV and go straight to onboarding, Undecided — need guidance

Are You Comfortable Being Blind to Real Threats?

• If critical alerts were slipping through right now, how soon would you expect someone on your team to know about it? Options: Within minutes, Within hours, Next business day, We often don’t know until much later
• How many alerts does your primary monitoring tool generate on an average business day? Options: <100, 100–500, 500–1,500, 1,500–5,000, >5,000, Don't know
• What percentage of daily alerts currently get a full analyst investigation rather than just a ticket creation? Options: >90%, 50–90%, 10–50%, <10%, Almost none
• Tell me about a recent alert or incident that you later realized was more serious than initially thought—what happened and what was the impact?
• How does it feel inside your team when you discover high-risk alerts weren’t investigated—annoying, alarming, helpless, or something else? Options: Anxious/Alarmed, Frustrated/Annoyed, Helpless/Overwhelmed, Motivated to change, Other

Who's Steering the Ship — Really?

• If we had to get final sign-off tomorrow, who holds the budget authority and what will they want to see to say yes? Options: CFO/Finance, CEO/Owner, IT Director, VP Operations, Board/Committee, Undecided
• What timeline would your decision-maker find acceptable from proposal to go-live? Options: <14 days, 14–30 days, 30–60 days, 60–90 days, Flexible
• What non-negotiable concerns does your CFO or finance owner raise when comparing outsourced MDR vs building an internal SOC?
• How does the VP of Operations weigh in on security work that could touch production systems—what would they absolutely not accept?
• Who on your side can approve emergency containment actions (e.g., endpoint isolation, account disable) during nights/weekends? Options: IT Director, CISO/Security Lead, Operations Manager, Designated Security Contact, No one — vendor must get approval

Where the Night Shift Is Missing

• Imagine an intrusion at 2 a.m.—what typically happens today, and how does that outcome make you feel about your overall risk?
• How often do incidents occur outside business hours and how disruptive are they when they do? Options: Weekly and highly disruptive, Monthly and disruptive, Rarely but severe, Very rare and minor, Unknown
• Would your team accept a vendor performing automated containment actions without prior approval if it reduced mean time to contain by 50%? Options: Yes — within agreed playbooks, Yes — but only with after-action review, No — must always contact us first, Depends on the severity
• Describe any previous night/weekend incident where delay in response caused measurable harm (downtime, data loss, regulatory risk)—what was the consequence?

What Would Success Actually Look and Feel Like?

• If we guarantee containment within a target window, what MTTC (mean time to contain) would transform how you feel about security? Options: <1 hour, 1–4 hours, 4–24 hours, >24 hours, Unsure — need guidance
• Beyond MTTC, what operational signals would convince you the service is working (pick all that apply)? Options: Faster onboarding time, Fewer false positives, Dedicated analyst familiarity, Clear incident playbooks, Regular tuned detections, Transparent SLA reporting
• How quickly would you expect full monitoring coverage after contract signature to be achieved? Options: <7 days, 7–14 days, 15–30 days, 31–60 days
• How will you measure ROI internally—what costs or risk metrics are you comparing against building a four-person SOC?
• When this is working well, how will it change your day-to-day for the IT director, your security team, and operations?

Surface the Technical Map We Need to Own Together

• What primary SIEM, EDR, or logging platforms are currently in place? Options: Splunk, Microsoft Sentinel, Elastic, QRadar, Sumo Logic, Native cloud logs only, No SIEM/EDR deployed, Other
• Which log sources are currently being forwarded (pick all that apply)? Options: Endpoints/EDR, Active Directory, Firewalls/Perimeter, Cloud (AWS/Azure/GCP), VPN/Remote Access, OT/ICS, Email/M365, HR/Payroll systems, Other
• Estimate current endpoint coverage (% of workstations/servers where agents could be deployed): Options: <25%, 25–50%, 50–75%, 75–100%, Unknown
• Are there operational technology (OT) systems, segmented air-gapped networks, or third-party vendor environments that require special handling? Options: Yes — OT/ICS present, Yes — highly segmented networks, Yes — third-party constraints, No special constraints, Unsure
• What current pain points exist with log quality, retention, or missing telemetry we should know about?

PoV & Risk: Can We Prove Value Without Putting You at Risk?

• If a 30‑day PoV reveals missed detections, how would you like that information presented to gain trust quickly? Options: Weekly executive summary + full findings, Daily highlights + dashboards, Live demo of specific detections, Walkthrough with our analysts
• What acceptance criteria will make a PoV a clear win for you (pick top three)? Options: Missed detection examples found, Baseline MTTC improvement, Full agent rollout on X% endpoints, Detection tuning completed, Analyst familiarity & handover, No production disruption during tests
• What change windows, maintenance blackout periods, or seasonal constraints must we respect during a PoV or onboarding? Options: Nightly windows OK, Only scheduled change windows, No changes during production hours, Seasonal blackout dates, Flexible — need to discuss
• What rollback or escalation plans do you require if the PoV causes unexpected issues?
• Are you willing to deploy temporary agents/connectors alongside your existing tools for the duration of the PoV? Options: Yes — fully supportive, Yes — but limited scope, Prefer remote/log-only observation, No — cannot deploy agents

People & Process — Who Lives This Day to Day?

• Who will be the day‑to‑day liaison for incident handling, and what authority will they have? Options: IT Director, Security Lead/CISO, Network Admin, Designated Security Contact, Other
• Which internal roles will we need to train or hand over runbooks to during onboarding? Options: IT Operations, Helpdesk, Network Engineering, Application Owners, VP Operations, Other
• How mature are your existing incident response runbooks on a scale from 1 (none) to 5 (rigorous and practiced)? Options: 1, 2, 3, 4, 5
• Describe one internal process that regularly blocks fast incident containment today (approval delays, lack of credentials, uncertainty about change windows, etc.):
• What cadence of operational reviews and tuning would you find reasonable after go‑live (pick all that apply)? Options: Weekly for first month, Bi-weekly for first quarter, Monthly ongoing, Quarterly strategic reviews, Ad-hoc as needed

Commercial & Commitment — The Financial and Contract Questions That Matter

• What procurement hurdles have blocked past security engagements from moving forward? Options: Lengthy legal review, Budget timing, PO/contracting process, Need multiple vendor quotes, Other
• Would your CFO accept a three‑year managed service with defined SLA credits over the engineering cost of building a four‑person SOC? Options: Yes — prefers managed service, Maybe — needs detailed TCO, No — prefers internal build, Undecided
• What contractual guarantees are deal‑breakers for you (minimum MTTC SLA, response authorities, liability limits, breach notification timelines)?
• What internal approval steps remain for budget sign‑off (committee meeting, CFO review, CEO sign, board approval, other)? Options: CFO only, CFO + CEO, Finance committee, Board approval, Other
• What commercial structure do you prefer for a three‑year agreement? Options: Fixed annual subscription, Monthly billing with term commitment, Year 1 ramp then flat, Performance‑based pricing, Undecided

Final Check — Readiness, Risks, and Next Steps

• What is the single biggest internal obstacle that would prevent a smooth PoV or onboarding in the next 30 days?
• On a scale from 1–5, how emotionally ready is your leadership to hand operational control for containment to a vendor during incidents? Options: 1, 2, 3, 4, 5
• Which three outcomes would make you feel confident to sign a three‑year MDR contract after the PoV?
• Who should be invited to the next technical scoping session (name, role, and preferred contact method)?
• Realistically, what's our next step together and when can we schedule it? Options: Technical scoping call (within 7 days), Executive commercial review (within 14 days), Begin PoV (within 30 days), Need internal alignment first

Quick Snapshot: Your Security Reality

• To get started, which best describes your primary business vertical? Options: Manufacturer (plants/OT), Distributor / Logistics, Professional services, Other — please specify
• How many people work across your organization? Options: 500–999, 1,000–2,499, 2,500–4,999, 5,000+
• Which team owns day-to-day security operations today? Options: IT / Infrastructure, Dedicated internal SOC, Third‑party MSSP, No single owner / shared responsibility, Other
• Roughly how many security alerts (SIEM/EDR/console) are generated on a typical business day? Options: <50, 50–199, 200–499, 500–999, 1,000–1,499, 1,500–4,999, 5,000+
• Who should we coordinate technical follow-up with (name & title)?

If We’re Honest, How Much Is Noise?

• What percentage of alerts do you believe are false positives or noise that never get investigated? Options: <10%, 10–25%, 26–50%, 51–75%, >75%, Unsure
• Which types of alerts generate the most noise in your environment? Options: Malware/AV detections, Authentication anomalies, Firewall/IDS alerts, Proxy/web gateway alerts, Vulnerability scanner alerts, OT/PLC alarms, Other — specify
• How long does an average alert sit in your queue before someone looks at it? Options: <15 minutes, 15–60 minutes, 1–4 hours, 4–24 hours, >24 hours, Never reviewed
• When alerts aren’t investigated, what typically happens to them? Options: Auto‑closed, Left in queue indefinitely, Ignored then deleted, Escalated later, Other — explain
• Tell us about one recent alert or small incident that was missed or deprioritized and later caused problems — what happened?

Who’s On Watch When It Matters?

• If your most senior analyst resigned tomorrow, what would happen to daily detection coverage? Options: Coverage continues with no impact, Some degradation but manageable, Significant loss of coverage, We'd be blind / unknown
• How many full‑time staff (headcount) actively investigate security alerts today? Options: 0, 1, 2, 3–4, 5+
• Do you have 24/7 shift coverage for monitoring and response? Options: Yes — internal team, Yes — via third‑party, No — business hours only, Partial after‑hours cover
• How experienced is your most senior analyst (years of hands‑on SOC experience)? Options: <1 year, 1–3 years, 3–5 years, 5–10 years, 10+ years
• Describe any recent staffing gaps, turnover, or single‑point‑of‑failure you worry about.

Where Your Tools Actually Reach — and Where They Don’t

• Which critical assets would you admit are effectively blind to your current monitoring? Options: OT / PLC networks, Remote or branch offices, Cloud workloads (IaaS/PaaS), Identity providers / SSO logs, IoT devices, Legacy on‑prem servers, Other — specify
• Which of these tools are actively feeding logs to your SIEM or monitoring today? Options: Firewall, EDR, Proxy / Web gateway, Active Directory / IdP, Cloud audit logs (CloudTrail/Azure), VPN / remote access, OT sensors / historians, Email gateway, Vulnerability scanner, Other
• Which vendors/products are in your toolchain (SIEM/EDR/Firewall)? List names and versions if known.
• Approximately what percentage of endpoints and servers can receive an agent today? Options: <25%, 25–49%, 50–74%, 75–94%, 95–100%, Unknown
• Are there technical or organizational constraints preventing log ingestion from specific systems? Options: Bandwidth limits, Change control windows, Legacy/unsupported devices, OT vendor restrictions, Data privacy/regulatory limits, No constraints, Other — describe
• If you had to pick the top three systems we must instrument first, which would they be and why?

When Detection Turns Into Disruption

• Which investigation or response actions would you consider unacceptable during production hours? Options: Isolating endpoints, Disabling user accounts, Changing network routes/segments, Restarting services/controllers, Making changes to OT systems, No action is off‑limits, Other — specify
• Have you experienced a situation where a defensive action caused operational impact or downtime? Options: Yes — major impact, Yes — limited impact, No, Not sure / never tracked
• Who must be notified or authorize containment before a high‑impact action is taken? Options: IT Director, VP Operations, CFO, Plant Manager / OT Lead, Security Lead / CISO, No prior authorization required, Other — list
• What rollback or escalation steps are in place if a containment action breaks something mission‑critical?
• How comfortable are you with a provider that will take immediate action to contain confirmed threats outside business hours? Options: Very comfortable, Somewhat comfortable, Only with pre‑approved playbooks, Not comfortable

Signals That Would Prove We’re Helping

• If we could guarantee one measurable improvement in the first 90 days, which would change your mind about outsourcing detection? Options: MTTC reduction, Fewer false positives, Faster onboarding to full coverage, Dedicated analyst assigned, Detecting previously missed incidents, Other — specify
• What is your current target (or expectation) for mean time to contain (MTTC)? Options: <1 hour, 1–4 hours, 4–24 hours, 24–72 hours, No target / unknown
• Which metrics are tracked today that we should baseline in the PoV? Options: MTTC / MTTR, Alert volume by source, Investigations completed, Incidents by severity, Dwell time, False positive rate, Analyst utilization, Other — list
• How often would you like status reports and what level of detail do you expect (daily high‑level, weekly dashboard, monthly executive)? Options: Daily — high level, Weekly — tactical, Biweekly — mix, Monthly — executive, On demand
• Would you want a single dedicated analyst assigned to your environment for the PoV and ongoing service? Options: Yes — dedicated, No — pooled model OK, Prefer hybrid (dedicated lead + pool), Unsure — discuss options
• By when would you realistically expect to be on full monitoring after contract signature? Options: Within 7 days, 7–14 days, 15–30 days, 30–60 days, Longer / depends

The Practical Constraints — Budgets, Timelines & Approvals

• What single outcome or event would make a three‑year managed service contract a non‑starter for your organization? Options: Budget cuts / reprioritization, Operational disruptions, Lack of executive buy‑in, Unacceptable contractual risk, Data residency / compliance issues, Other — explain
• What is your procurement timeline for selecting an MDR provider? Options: Immediate — weeks, This quarter, Next quarter, 6–12 months, Undecided
• Who will sign the SOW and who approves the budget for security services? Options: IT Director, CFO, VP Operations, CEO, Procurement, Other — list
• What annual budget range are you evaluating for outsourced detection & response? Options: <$100k, $100k–$250k, $250k–$500k, $500k–$1M, >$1M, Undecided
• Do you have contractual or regulatory SLAs that an MDR provider must meet (response times, data retention, auditability)? If yes, please list.
• Are there any internal change‑control or maintenance windows that would limit onboarding activities or agent deployments? Options: Daily business hours only, Night/weekend windows available, Weekly maintenance windows, Change freeze periods exist, No restrictions, Other — describe

Start Here: A Quick, Honest Snapshot

• Who are you and which team owns security day-to-day here? Options: IT Director, Security Manager, CISO/Head of Security, VP Operations, Other
• How many employees and locations should we use when sizing a monitoring plan? Options: <500, 500–1,000, 1,001–2,500, 2,501–5,000, >5,000
• How urgent is solving this monitoring gap on a scale from 1 (not urgent) to 5 (critical)? Options: 1, 2, 3, 4, 5
• Who will be the primary point of contact for onboarding and day-to-day decisions?
• When we talk about success for an initial conversation, what’s the single outcome you most want from this call? Options: Get a PoV plan, Understand commercial terms, Validate coverage needs, Quick risk assessment, Other

Are You Comfortable With What You Don’t Know?

• If an attacker was already in your environment today, how confident are you that you'd notice within 24 hours? Options: Very confident, Somewhat confident, Not very confident, Not confident at all
• What blind spots worry you most right now (pick all that apply)? Options: Remote workforce endpoints, OT/ICS systems, Cloud workloads, Third-party contractors, Identity/account compromise, Other
• Tell us about the last time you learned of an incident—how did you find out and how long did it take to triage?
• How often do you suspect false negatives—events you later learned were real threats but weren’t detected? Options: Regularly (monthly+), Occasionally (quarterly), Rarely, Unsure
• How does it feel when you realize something slipped past your tools—frustrated, resigned, alarmed, or motivated to change? Options: Frustrated, Resigned, Alarmed, Motivated to change, Other

What’s Driving Everyone Crazy Right Now?

• Would you say alert volume is a symptom you tolerate—or a problem you’re actively trying to fix? Options: Tolerating, Trying to fix, Not sure
• Approximately how many SIEM/EDR alerts come in on an average business day? Options: <100, 100–499, 500–1,499, 1,500–5,000, >5,000
• Which tools generate the majority of noisy alerts in your stack? (select all that apply) Options: SIEM, EDR/Endpoint agent, Cloud provider alerts, Network IDS/IPS, Email security/Gateway, VPN/Remote access, Other
• How much of that daily alert volume actually gets investigated to conclusion today? Options: >90%, 50–90%, 10–50%, <10%, Almost none
• Describe a recent example where alert noise caused a missed or delayed response—what happened and what was the impact?

What’s Getting in the Way of Taking Action?

• If you had to pick one structural reason investigations stall, what is it—staffing, tooling, processes, or leadership priorities? Options: Staffing, Tooling, Processes, Leadership priorities, Other
• How many full-time people (or FTE-equivalents) are currently responsible for triage and incident response across all shifts? Options: 0, 0.5–1, 1–2, 3–4, 5+
• Do your analysts cover multiple customer environments/tools or are they dedicated to your environment? Options: Dedicated to our environment, Shared across multiple environments, Don't have consistent analysts, Unsure
• Which of these skills are hardest to recruit or retain in your team? (select up to 3) Options: Threat hunting, Forensics, Detection engineering, Cloud security, OT/ICS expertise, Level 2/3 triage
• How does the operations team feel about after-hours investigations or containment actions that could impact production? Options: Strictly prohibited, Allowed with pre-approved runbook, Allowed if critical, No clear policy

If We Could Snap Our Fingers, What Would Change?

• What would a meaningful reduction in risk look like to you—faster containment, fewer false positives, broader visibility, or something else? Options: Faster containment, Fewer false positives, Broader visibility, Dedicated analyst(s), Custom detections, Other
• What target mean time to contain (MTTC) would satisfy your leadership—hours, days, or other metric? Options: <1 hour, 1–4 hours, 4–24 hours, 1–3 days, >3 days or N/A
• How important is having dedicated analysts (one team focused only on you) versus a pooled model that rotates across customers? Options: Very important, Somewhat important, Not important, Open to either
• What level of autonomy should a provider have during incidents (isolation, account disablement, network quarantine)? Options: Full autonomy, Autonomy with notification, Requires approval every time, Case-by-case
• Which KPIs will your CFO or exec team require to justify a three-year managed service? Options: Total cost of ownership, MTTC improvements, Reduction in incidents, Compliance posture, Time-to-onboard, Other

Who's Holding the Keys — and the Approval Stamp?

• If the project needs a yes from three people, who are they and what does each care about most?
• Which of these best describes your procurement/contracting timeline once commercial terms are agreed? Options: Weeks, 1–2 months, 2–3 months, 3+ months, Depends on legal review
• Who owns the budget and how will they evaluate the three-year cost versus building internally? Options: CFO/Finance, IT Director, Procurement, CEO/Exec sponsor, Other
• What contractual guarantees are non-negotiable for you (response SLAs, uptime, confidentiality, liability caps)? Options: Response SLAs, RPO/RTO, Confidentiality, Liability caps, Regulatory clauses, Other
• Who in your organization will sign off on live response permissions (isolate endpoints, disable accounts) and how quickly can they act? Options: IT Director, VP Ops, CFO, Legal, No single approver

Hidden Obstacles: Tech, OT, and Change Windows

• What operational technology (OT) or legacy systems exist that are sensitive to changes or agent installation? Options: SCADA/PLC, Manufacturing execution systems (MES), Proprietary controllers, None, Unsure
• Are there any networks or segments where we absolutely cannot run active scans, agents, or intrusive detection? Options: Production/OT segments, Guest/contractor networks, HVAC/building controls, None, Other
• What are your routine maintenance/change windows (days/times) when we could schedule agent rollouts or configuration updates? Options: Weekday business hours, Weekday off-hours, Weekends, Monthly maintenance window, No regular window
• Do you have IAM/SSO restrictions or sensitive privileged accounts that require special provisioning steps? Options: Yes, strict, Yes, moderate, No, Unsure
• Are there regulatory or compliance rules (HIPAA, PCI, NERC, ITAR) that constrain incident response or data handling? Options: HIPAA, PCI, NERC, ITAR, GDPR, None, Unsure
• Tell us about one technical constraint you expect will slow onboarding (network segmentation, air-gapped systems, legacy auth), and how you currently work around it.

How Would a 30-Day Proof Actually Prove Value?

• If we run a 30-day PoV alongside your existing tools, what evidence would make you say 'this works'? Options: Missed detections found, MTTC improvements, Cleaner alert triage, Operational handoff readiness, Other
• Which log sources are available for immediate ingestion to support a PoV (select all that apply)? Options: Windows events, Syslog/network devices, Cloud provider logs (AWS/Azure/GCP), Email/Gateway logs, EDR logs, IAM logs, Other
• What percentage of endpoints and servers could we realistically install a lightweight agent on within the first 14 days? Options: <25%, 25–50%, 50–75%, 75–95%, 95–100%
• What would be the non-negotiable acceptance criteria at PoV completion (e.g., X missed detections surfaced, MTTC < Y hours)?
• Who must be engaged internally during the PoV (IT ops, SOC, OT engineers, legal), and who will own the day-to-day PoV communications? Options: IT Ops, SOC/Analysts, OT Engineers, Legal/Compliance, Executive Sponsor, Other

If We Move Forward, What Could Kill the Project?

• What are the top three deal-breakers that would stop you from onboarding an MDR provider?
• Are there access or network changes we should expect resistance to (VPN access, privileged credentials, opening collector ports)? Options: Yes — significant resistance, Some resistance expected, No resistance, Unsure
• What escalation and rollback processes must be in place before any containment or disruptive actions can be taken?
• Who will be our escalation path during an incident outside business hours, and what is the expected response expectation? Options: IT Director on-call, VP Ops on-call, Dedicated incident response contact, Rotate through team, No defined after-hours contact
• Which legal or procurement steps have historically delayed security projects here, and how long do those typically take? Options: Security review, Legal contract review, Insurance requirements, Third-party vendor onboarding, Other

Putting It All Together: Next Steps and Comfort Level

• Based on everything above, how comfortable would you be signing a three-year managed service agreement after a successful PoV? Options: Very comfortable, Somewhat comfortable, Not comfortable yet, Need more info
• What immediate resources or information do you need from us to move to a PoV (statement of work, agent docs, security questionnaires)? Options: Security questionnaire, Statement of work, Agent deployment guide, SOC procedures, Contract template, Other
• Who should we invite to a technical kickoff to ensure the PoV can start within your preferred timeline?
• Realistically, what date could your team commit to starting a PoV or pilot (give a target month or week)?
• Is there anything we haven’t asked that would make a huge difference in understanding your situation or ensuring a smooth onboarding?

Start Here: Tell Us About Your Situation

• In one short paragraph, how would you describe the security situation that brought us together today?
• Which best describes your organization’s employee size? Options: Under 500, 500–999, 1,000–2,499, 2,500–4,999, 5,000+
• Which industry best fits your organization? Options: Manufacturing, Distribution / Logistics, Professional Services, Healthcare, Financial Services, Other
• Who is the internal owner driving the MDR evaluation? Options: IT Director, Security Manager, CIO/CTO, VP Operations, CFO, Other
• How many full‑time people are currently dedicated to security or SOC functions? Options: None, 1, 2–3, 4–6, 7 or more
• What immediate event or trigger prompted this exploration (select all that apply)? Options: Senior analyst resigned, Too many SIEM alerts, Recent suspicious activity, Compliance requirement, Executive request, Budget review

Are You Comfortable Flying Blind?

• If your SIEM is screaming with alerts, what percent of those alerts do you honestly believe are investigated to a conclusive outcome? Options: 0%, 1–5%, 6–20%, 21–50%, Over 50%
• On a typical day, roughly how many alerts does your environment produce? Options: Under 100, 100–499, 500–1,499, 1,500–4,999, 5,000+
• What percentage of alerts receive human triage (not just automated ticketing)? Options: None, <10%, 10–30%, 31–60%, >60%
• Which detection and visibility tools are in place today? (select all that apply) Options: SIEM, Endpoint Detection (EDR), Network Detection/Analytics (NDR), Cloud workload logging, Vulnerability scanner, Identity provider logs, None / minimal tooling
• Tell us about a recent alert or near‑miss that made you question whether your monitoring is sufficient—what happened and how did it feel?
• How confident are you that current tooling and staffing would detect and contain an attack against critical OT or industrial control systems? Options: Very confident, Somewhat confident, Not confident, Not applicable—no OT

Who Really Decides — And What Keeps Them Up at Night?

• If your CFO ran the numbers comparing building a four‑person SOC to outsourcing detection and response, what single concern would make them immediately push back?
• Which stakeholders must sign off on a three‑year MDR contract? (select all that apply) Options: IT Director, Security Manager, CFO, CEO, VP Operations, Legal, Procurement
• Which budgeting model does leadership prefer for this purchase? Options: OpEx / annual, Multi‑year OpEx (3 years), CapEx, Unsure / flexible
• What operational constraint from VP Operations is non‑negotiable (e.g., no production interruptions during business hours)? Options: No production interruptions during business hours, No agents on certain systems, Change windows limited to specific weekends, Response actions require prior approval, Other
• What is the target timeline leadership expects between agreement and the point at which risk is meaningfully reduced? Options: Within a week, 2 weeks, 1 month, 2–3 months, Unsure
• If procurement or legal delays the decision, what real business risk do you foresee in the next 90 days?

What Would Success Actually Look Like — Not Just a Dashboard

• If you could measure just one outcome to prove this engagement succeeded, what would it be?
• Which of the following metrics will best indicate success for your team? (select up to three) Options: Mean time to contain (MTTC), Mean time to investigate, Percent of alerts closed to conclusion, Days to full monitoring after signature, Reduction in false positives, Dedicated analyst ratio
• What MTTC target would make you feel confident incidents are being contained appropriately? Options: Under 30 minutes, 30–120 minutes, 2–8 hours, 8–24 hours, Not sure / need recommendation
• How soon do you expect full coverage (all agreed log sources and endpoints) after contract signature? Options: Under 7 days, 8–14 days, 15–30 days, More than 30 days
• What types of detections or threats are highest priority for you (e.g., credential theft, ransomware, insider misuse)? Options: Ransomware, Credential compromise, Data exfiltration, Insider threat, Supply chain compromise, OT/ICS attacks
• Which outcome would make your VP Ops and CFO publicly congratulate the security team one quarter from now?

Imagine a 30‑Day Proof That Changes the Game

• What would you assume a PoV provider might gloss over or not show you—if they could—and why does that worry you?
• Which acceptance criteria must the 30‑day PoV meet for you to call it successful? (select all that apply) Options: Demonstrated missed detections compared to current tools, Onboarded target log sources, Established MTTC baseline, Documented tuning reducing noise by X%, Analyst handover and knowledge transfer
• Which log sources and systems must be included in the PoV to make it meaningful? (select all that apply) Options: Active Directory / identity logs, Endpoints / EDR telemetry, Domain controllers, Cloud workloads (AWS/Azure), Email gateway, Network devices / firewalls, OT/PLC systems
• Are there internal approvals, vendor contracts, or remote access constraints that could delay PoV work? Options: Yes — vendor approvals required, Yes — internal change approvals required, No known constraints, Unsure
• How many engineering or admin hours can your team commit during the PoV for connector work, tuning, and validation? Options: None, <8 hours, 8–24 hours, 25–40 hours, >40 hours
• What single result from the PoV would most convince your leadership to proceed to a full engagement?

Who Owns Response When Things Go Wrong?

• If an analyst recommended isolating a production server at 2:00 a.m., who in your organization should have the final say—and why?
• Which response actions are you comfortable delegating to an external provider without prior approval? (select all that apply) Options: Isolate endpoint, Disable user account, Block IP at edge, Quarantine files, Initiate forensic capture, None — all require approval
• Do regulatory, customer, or contractual obligations restrict autonomous response activities? Options: Yes — specific restrictions apply (we'll detail), No, Unsure
• Describe the escalation path you expect for a confirmed critical incident—who is notified and in what order?
• Have past response actions ever caused unacceptable downtime? If so, tell us about one example and what you learned.
• Which blackout periods do we need to respect to avoid production impact? (select all that apply) Options: Business hours M–F, Night shifts only, Weekend operations, Monthly maintenance windows, No blackout — any time is acceptable

What Would Make Signing a No‑Regret Decision Easy?

• If you could extract one contractual promise that would remove the last reservation from your leadership team, what would it be?
• Which commercial term length would your leadership prefer to evaluate first? Options: 12 months, 24 months, 36 months, Other / flexible
• Which SLA guarantees are non‑negotiable for you? (select all that apply) Options: Critical incident response time, MTTC contractual commitment, Platform uptime, Regular executive reviews, Financial remedies for SLA failures
• What internal approvals must be completed before signature (select all that apply)? Options: Legal contract review, Security architecture review, Procurement approval, Budget signoff (CFO), Executive sponsorship
• What would be a reasonable timeline to convert a successful PoV into a signed agreement? Options: Sign within 14 days, Sign within 30 days, Longer negotiation required, Unsure
• Who will serve as the single point of contact for commercial negotiations and who will own technical onboarding? Please name roles and emails if possible.

Small Technical Reality Check — Are We Ready to Move Fast?

• If we committed to completing onboarding in two weeks, what single thing in your environment would most likely break that plan today?
• Which operating systems and endpoint protection products dominate your estate? (select all that apply) Options: Windows (various versions), macOS, Linux (server/desktop), Industry / legacy OT OS, Third‑party endpoint protection (specify)
• Which identity providers or SSO systems must we integrate with? Options: Azure AD, Okta, Google Workspace / G Suite, On‑prem Active Directory, None / other
• Please list any systems or device classes where agent installation is prohibited or restricted.
• Do you have an existing incident response runbook we should align with? Options: Yes — mature and published, Yes — draft, Under development, No
• How would you prefer we communicate progress during onboarding and the PoV? (select all that apply) Options: Daily standup calls, Twice‑weekly written summaries, Weekly exec review, Dedicated Slack / Teams channel, Email only