One of the challenges that modern CISOs face is knowing where to channel investment. And given that there are many vendors, often offering similar services, choosing a provider or product can be difficult.<\/p>\n\n\n\n
A good vendor-end-user relationship based on trust and long-term partnerships is crucial.<\/p>\n\n\n\n
We asked three industry experts how vendors and end-users can get the best out of their partnerships. Here’s what they had to say…<\/p>\n\n\n\n
Ghazal Asif, Senior Director of Worldwide Channels at Cybereason<\/strong><\/p>\n\n\n\n Build the human connection<\/strong><\/p>\n\n\n\n In an age of rapidly evolving technology, we often forget the importance of the human connection. At the heart of every great relationship is a feeling of mutual trust. Building trust requires time and patience. The former is something we don\u2019t have, especially when there are so many vendors knocking on end-user doors. Once an end-user has identified a shortlist of vendors they will partner with (in a project, or generally), make the time to build the trust and relationship outside of the office. Coffee, dinner, a round of golf \u2013 there are unlimited ways to build the human connection.<\/p>\n\n\n\n Most strategic partnerships span across multiple business units and\ndisciplines between end-users and vendors. For example, a CISO to CISO connection is\nexcellent, and necessary, but going up and across the organisation and making\nthose peer-to-peer connections gives both parties a fuller picture on the\norganisation. For example, end-user procurement staff connecting with vendor\nprocurement staff can lead to a better understanding of the paper process and\npotentially good practice sharing. <\/p>\n\n\n\n The\nstrongest end-user and vendor relationships are based on creating value. This\nis especially important for vendors. The only way to create value for an\nend-user is to truly understand and empathise with the pain in their role,\nfully understand the priorities and then find ways to create value. Creating\nvalue can be done through sharing best practices, sharing key research that\naligns to their pain and desired outcome, leading workshops with the end-user\nteams for knowledge sharing and finding ways to share relevant expertise from\nthe work completed by the end-user. <\/p>\n\n\n\n Agreeing\nto a joint success plan which is fully documented is a fantastic way to ensure\nthe end-user gets the most out of the investment. A\njoint success plan should include quantifiable metrics on what success looks like,\nespecially post-sales. This is also a great way for the end-user to hold\nthe vendor accountable.<\/p>\n\n\n\n Priorities change regularly for companies and pains experienced by one end-user will quite likely be dramatically different with others within the same company. This makes it imperative to set expectations on timelines and communication in order define what a great outcome will be for the end-user. <\/p>\n\n\n\n In addition, the more transparent end-users can be with vendors\nregarding goals, objectives and outcomes, the more likely of achieving success. It could be something\nas simple as scheduling follow up phone calls. If the end user isn\u2019t interested\nin receiving calls on a certain day or time because of other commitments, its\u2019s\nimportant for the vendor to know this. <\/p>\n\n\n\n Maybe the end-user doesn\u2019t want a follow-up call on a Monday because their calendar is already filled with existing appointments. Therefore, scheduling the call on a Tuesday could go a long way in building trust. It seems simple but working extremely hard to not lose control of the basics is important. <\/p>\n\n\n\n Richard Archdeacon, Advisory CISO at Duo Security<\/strong><\/p>\n\n\n\n As businesses demand greater agility and\nflexibility for their in-house and external teams, vendors must reflect that\nchange. This is particularly important in the area of security which, although\nvital to the success of an organisation, is not often seen as necessary. <\/p>\n\n\n\n An author wants to write, a designer to design. They do not come in to work to be a security professional. So success will depend on the vendor ensuring that the end-user works in partnership to secure the organisation.<\/p>\n\n\n\n Vendors must ensure solutions are easy to use\nand do not impede the user and their work experience. A\nkey way in which vendors can work with end users is to focus on the design of\ntheir solutions and ensure that they are effective but easy to use. <\/p>\n\n\n\n An example of this would be ensuring a common\nexperience across all the platforms open to end users in their daily activities\n\u2013 a solution should be similar across laptops, mobile phones and intelligent\nwatches. <\/p>\n\n\n\n The vendor needs to ensure that the functional\nrequirements are implemented without interrupting the user workflow. <\/p>\n\n\n\n If it interrupts what a person needs to do it\nwill create a negative experience and, understandably, users will develop\nworkarounds, therefore undermining the purpose of any control. <\/p>\n\n\n\n By making authentication simple\nwhilst running checks on devices in the background, end users can stay secure\nwithout degrading performance or interrupting work. If an update is\nneeded to a device then rather making it intrusive the vendor can develop an\napproach which includes the end user in the decision and implementation\nprocess. <\/p>\n\n\n\n To develop these solutions, vendors need to\nhave a programme which includes end users in the development of new\nsolutions. <\/p>\n\n\n\n Making it easy to use is the first step but ensuring that end users test it and provide their input is a critical second step before release. So keeping it simple and consistent while supporting \u2013 not interrupting \u2013 the end user is the way to get the best out of the partnership.<\/p>\n\n\n\n As a society, our digital lives are dependent\non code, whether it\u2019s managing our banking, controlling our vehicles and\ncritical infrastructure or operating our medical devices. Meanwhile, every\nbusiness now relies on software as a source of strategic differentiation,\ncompetitive advantage and top-line revenue generation. Cyberattackers have taken\nnote of this increasing attack surface, compromising systems at an alarming\nrate, and breaches are hurting companies.<\/p>\n\n\n\nPaul Farrington, EMEA CTO at Veracode<\/strong><\/h4>\n\n\n\n