Vendor Assessment Community – Antoine Damelincourt, IANS

This is Techstrong tv. Hi everybody. Mike Rothman here, general manager of Techstrong Research with another TECHRON TV interview.

Very pleased to be joined by Antoine dho. Uh, who is the VP of Product, I guess something, or Director of product, or Just just a, just a director. Just a director of Director.

Just Director of Director of director of ions, which is, uh, uh, uh, information Security Research and Advisory Firm. Our full disclosure, I've actually been an IONS faculty member for over 15 years, so I know the organization extremely well. Uh, we are here to discuss the new offering that they have called the, uh, uh, vendor Assessment Community or v c, but I wanna steal all of Antoine's Thunder.

So, Antoine, welcome to Text on tv. How are you today? I'm great, thanks, Mike.

Thanks, uh, thanks for having me. And yes, we'll, uh, there's no, there's no funder to steal, I think V a c, uh, we can call it V aac cuz Vendor Assessment Committee is a mouthful. No, I'm just very excited to be here today.

It is, it is a mouthful. So, before we get going again, obviously I know all about Ions cuz I've been affiliated with the company for 15 something years. Uh, why don't you just give the audience a little bit of a sense of, of what s is about, uh, you know, kind of some of the offerings, how, how we do business, uh, and then we can, you know, really dive into, into bac.

Cuz I think it is gonna be interesting to our, our, our, uh, subscribers here. Sounds good. Yes, because yeah, you, you've been an ION faculty for 15 years.

Most of the people watch Shane have not. So, uh, yeah. As, as you said, we're a research and advisory company.

And to make it very simple, our goal is to help information security teams make better decisions, more informed decisions, and, and generally go faster since save time. Uh, if, if that was, to summarize it even shorter, if something matters to a ciso, it matters to us and we need to try to help CISOs to, uh, to deal with that. And the way we do it is that we've got a network of cybersecurity information security experts, people like Mike Rothman, uh, which we call the Ions faculty.

And we've got a about 110 hundred 11, uh, of those experts now and or customers can leverage, uh, the expertise, uh, of, uh, that faculty through different, different mediums. You could do, like, the, the most common way would be to do what we call an as an expert call, uh, directly with, uh, with an expert and ask them some questions. But there's also sorts of re reports, insights, webinars being published.

We have a professional development, uh, offering. We do some consulting. Uh, we've offered community services.

So basically just trying to help the information, community security, uh, community and, and provide resources there. Y you bet. And, and you know, from my perspective, I think a lot of the value comes from being able to bounce ideas off of folks that do this stuff for a living, right?

So I'm spending a whole bunch of time, you know, obviously Tetron, but talking to all sorts of folks. I've, you know, been immersed in cloud security for over a dozen years, right? I've been doing security monitoring for longer than that, and I end up getting to talk to a lot of s clients that provide some guidance and some perspective about the problems that, that they're, you know, seeking.

And that tends to be a, a one-on-one call where we can really dig into, uh, a specific issue that the client is, is working on. But as we have less time, right, as you're just looking for more information, I know, you know, kind of the company has introduced a portal with a whole mess of, of content that that's on it and really trying to foster that community. So, y y you know, we do forums around the country, so I don't wanna say, you know, 12 to 15, you know, different, you know, one day events where you get a chance to come and meet not just the faculty members, but a whole mess of, uh, of other, you know, kind of practitioners in your area.

Um, and again, really about fostering that community. And, and, and the vendor assessment community is really another, you know, kind of, uh, evolution, uh, of being able to, to help folks interact and make those better decisions. So why don't you kind of dig into, you know, what the V A C actually does, uh, and how folks would, would really leverage it.

Sure. No, and, uh, thank, thanks for curing me, uh, cuing me up like that. So V A C is an unbiased, uh, independent practitioner perspective.

I'm, I'm really honing in on that word cause you just mentioned practitioner and the, the fact that people want to hear from their peers from other practitioners, uh, which could be faculty or could be, could be ion's customers, and that that's really what's important. Uh, but so unbiased content on vendor selection, uh, coming from ION faculty, but also coming from the community themselves from ion's customers, uh, in the form of case studies. And the goal, once again, is to save time and make better decisions this time related to security vendors, of which there are quite a few to, to select from.

And it's a, it's a complex field, right? There's a, there's a lot that could go wrong. Decisions are are complicated.

So with V A C, we're trying to support that process of picking vendors, uh, at different key moments through that process. But like, before you start searching, do you need to get into this, this space in the first place? Do you need a solution?

You could save yourself a whole lot of trouble, uh, answering that question. And then if you decide that yes, you do need, in fact get to E D R to get, get into soar, what vendors are the right fit for me? Uh, can I, can I narrow the field a little bit?

Uh, and what criteria should I look at? And then once you've narrowed it down further, take a look at how your peers have solved both of the same, a similar problem. What were some of the lessons learned from, uh, from their experience?

And, and then generally throughout the entire process, how can I better manage my, my vendor stack and my technology stack? So that's, that's what we're trying to do with v c for different types of documents, both from the faculty and from the community. And, and I think it's, it's critical to understand that unless you're literally a launch customer for a new category, that becomes something pretty significant.

Someone else has gone through this process, right? Someone else has figured out whether they needed, you know, this, uh, you know, whether it's a new widget or some kind of new service or, uh, a capability, somebody has determined what their shortlist is for that technology. Somebody has put the RFP together, somebody has gone through the proof of concept of proof of value initiative.

Somebody's implemented it, somebody's managed it over time. And I'm just always been a big fan of trying to learn from other people's mistakes, right? And I think that's a big aspect of, of what, you know, ION is trying to do here, really.

And it just goes back to decision support general in that, you know, if you can leverage other people's expertise, uh, as opposed to having to learn it the hard way, you know, you're, you're gonna be better off in. And that's something I wish I could impart to my kids, but they seem to wanna just make their own mistakes over and over again, even though I tell them, no, no, I did that, don't do that. That doesn't end well.

They've gotta figure it out themselves. Hopefully the audience, you know, and, and obviously I subscribers, uh, are a little bit smarter than that and, uh, can try to, to leverage, you know, again, other people's experience and, and, and really pitfalls and really to, uh, avoid them. Yep.

No, I, I think that's salty, right? And that's, uh, that's what we're trying to do. Someone has gone through it, uh, or faculty either are using those tools themselves or have done some consulting missions have, you know, helped some of our customers implement them.

I, I've gone through that, that ringer of getting, getting a product to work. Uh, and obviously our customers have done gone through that process as well. So can we leverage that past experience?

Can we give people some data points that we can use to make their decisions? Or an even more fundamental point, it's not even leverageable point those data points. Not to just to make a decision, but to ask the right questions when you are talking to vendors, uh, because that's, that's be better prepared.

Uh, I, I think is also a better, is is also a way to, to look at this. That's right. So, so, you know, we probably should at least address you, you know, one of the elephants in the room, or maybe the two elephants in the room, uh, right.

And a lot of people use documents like, uh, Gartner Magic Quadrant or Forester Wave as, you know, kind of a mechanism to be, you know, kind of make decisions or at least, you know, kind of provide some guidance in terms of, you know, their procurement process. So, um, how does V A C really stack up, you know, how would you kind of say if a company already subscribes to Gartner, you know, what's the value in, uh, engaging with va, you know, in, in the v AAC community, I guess that would be the department of redundancy department. So you, you, you know, the vendor assessment community, uh, as much of a mouthful as it is, uh, you know, when they already maybe have access to, to the magic water, Right?

And I, I think that's an absolutely valued question. Uh, it is indeed the, uh, the elephant in barum. Um, I would say there are three, uh, three main ways we differentiate our selves from the, those, those existing companies that might be embedded in, in people's vendor selection process.

Um, I think the first one is that we're really, really focusing on information security. Uh, Gartner and Forrester, they cover a much broader scope in that, right? Uh, everything that s does is focused on the ciso, their teams and information security.

We're really, really, uh, specialist and experts in that, in that particular domain. So we're now not gonna try to get into, uh, expand that coverage beyond, uh, beyond InfoSec. That's the fir that's, that's the first item.

And as still, actually, still, still in that first item, not only are we focused on cybersecurity, we're focused on the practitioner, uh, everyone that provides information to vc, they're not analysts. They're not people that just look at solutions and, you know, and get briefings. They use the solutions.

They're, they're, they're practi practitioner. So I, I think that's the first, first item, the tap practitioner's experience. The second one, I think, is that we're, we're unbiased.

And we're unbiased, not of, we're not rid of human bias, but we're rid of vendor influence in the process. We're not getting briefings from vendors as we build the research. Uh, we're not taking money from vendors and we're not selling the content to vendors so that we can republish it and use it as, as a lead generation tool.

So the process is a little bit cleaner in, in that matter. Uh, but we're really, really trying to, to get the vendors out of the equation, uh, as we provide our research. And finally, the third one, uh, is more about the way we frame our research.

We're not trying to establish a ranking of vendors. We're not about winners and losers, and this is the best in breed. This is the niche player.

What we're trying to do instead is focus on the fit and the context. It's not about the best e d r solution or the best, so provider, it's about the right solution for you. If you're trying to do this.

You don't need the best of breed. If you just have a couple use cases that you're really interested in, maybe you can leverage some, uh, um, some capabilities elsewhere in your technology stack. So I think these would be the three main differentiators that, uh, uh, would from, from the, the elephants in the multiple elephants in, You know, you know, Antoine, uh, again, is a little bit of a strange, you know, kinda interview for me just because I, I know the company so well.

And, um, you, you, you know, obviously I have, I have many years of experience, you know, working with, uh, clients from that standpoint. I'll, I'll add a fourth, right? And, and, and the fourth is, y you know, it, it's really about more than the shortness, right?

And, and, and I think that, you know, kind of where the wave and, and, and what the magic quadrant do is really set up that first, Hey, here's the problem, not your problem to be clear, right? But here's the problem and here's, you know, kind of a bunch of vendors. And, you know, we try to, you know, get a sense of, of who's leading, you know, versus who isn't leading.

But then it's like, hmm, good luck. You know, gimme a call if you got a problem, uh, on that front. And, and, and I do think that, you know, uh, again, most folks haven't been through the process.

They don't understand the pov, they don't understand the implementation plan. They don't understand ongoing, you know, management of the solution. And that's really where I think, uh, this community approach can, can add accretive value above and beyond just looking at the chart.

And when somebody asks, why did you pick these folks? Right? You can say, look, they're on the chart, right?

You know, it's really about, you know, kind of having a good successful outcome, you know, to the project, rather than, you know, again, just covering your backside, you know, with, uh, the industry standard, you know, or the leader, whatever that means. And really getting at what the right solution is gonna be for the organization as opposed to, uh, again, what everybody else is doing. Because, you know, sometimes that'll work and other times not so much.

Yeah. And, and that's why I think I really like the case studies that we're doing with customers because they tell the entire story. That's, it's not just about, oh, we assess the capabilities and people ranked, you know, this was green, this was yellow, this was, uh, this was red.

It's about we had a problem. We tried, we, we thought it through that way. These, these were the criteria that were important to us.

These are the vendors we talked to. This is who we went into a poc. We picked vendor A because of these reasons, but we don't stop there, right?

So, because once you pick the vendor, that's, that's only the beginning, right? Because you need, you need to go for implementation, uh, is very customization. Do you need to work to build the necessary integrations?

Do you need to train your teams? Do you have to pay for training? Do you need to bring in more people to run the tool?

Uh, how do you get into all those, you know, everything that could go wrong on the back end of a process once you've picked a vendor. And that's both, both case studies have been fascinating, uh, to me. Cuz I sit on the interviews that we do with, uh, with customers to, to build them.

And every story is different. I've done, I've done about 30 of them right now, and every story ends with, you know, a, a different thing. Sometimes people go back to their incumbent because we realize that, oh, we were promised something and, uh, we thought we could get, we could do something better.

But it doesn't work that way. Sometimes it's a dream story, sometimes it's a nightmare. You get the horror stories.

It's, it's just, yeah, as an observer, it's, it's, it's endlessly fascinating. Welcome to my world. I've been doing this for a long time and, and a similar type of mechanism.

So it's so very interesting. So let's talk a little bit about what's available now. What's coming, you know, what are the topic areas that, uh, you're focusing on with, with the bac?

Yep. So one thing we're trying to do with v C in terms of coverage is that we want to have two drivers, uh, of the domains we cover. Uh, we want to have an editorial angle.

So we want to, you know, talk to faculty, talk to our research team and define what key core capabilities we want to cover, uh, and, and build a calendar off of that. But we also want to have community requests. We also want to have our customers tell us, well, I need advice on Secure Gateway.

I need Avi advice on API security. And, and then with that into that HR calendar. So just, just wanna keep in mind that we are those two pillars of what we define and then where the community takes us.

Uh, with that in mind, uh, for launch, we were targeting nine key domains, once again, from, from that editorial, uh, ions defined standpoint. Uh, and these were key capabilities such as, um, I, I apologize, I'm gonna rattle off a list of three letter and four letter acronyms. Uh, but we had, IM Pam, E d r Soar, C s p m M S S P Zero Trust, third-Party Risk Scoring, and s s E.

So that was what we were targeting at Launch and we launched last month. Uh, and beyond that, we already had, uh, have added documents beyond that scope based on the customer request. So, uh, secure Gateway, api, uh, network Secure Security Management.

So another, another acronym, uh, is gonna get added to the list. So I, I like that it's, uh, it's a pretty healthy pipeline and it's also pretty, uh, organic way of growing the content. Cause we're getting requests as to what's relevant for people.

And if we get a request for one document, then we figure that we can probably build it up, build that, that collection of that domain a little bit. And that really helps us drive, uh, drive, drive the content. But one thing that will also, sorry, and I'll stop talking, I promise.

Uh, but one thing to keep in mind is that, uh, we're talking about the vendor landscape, which changes very, very quickly. So we have an update policy for documents. So if something comes from the ENDS faculty, it needs to be revised at least every six months just to make sure that the information is still correct.

So, No, that's, that's helpful. I mean, obviously it's a very dynamic environment, so how do folks get access to the v c? They, they need to be a subscriber to Yeah.

You know, decision support. So why don't you explain that for a minute and then we'll give some contact info so folks know where to where to find you guys. Sure.

So yeah, so going back to what we were saying about ions as a company vendor, not vendor, but ADVI advised Firm Research, uh, it's a subscription offering. So you've, once you become an Alliance customer, you, you've got access to that faculty, uh, that, that network of faculty expert. You get access to the portal, you get access to all the content we have, uh, so fa that is our base subscription offering.

And D A C is an add-on to that offering, uh, specifically centered on vendor. So that is, yes, you, you do need to be an Ions customer. com, uh, there will be, um, documentation on our services or subsequent offering DAC specifically, there's gonna be a list of all our faculty, including a nice picture of you, Mike.

Uh, nice. Yeah, well, that, that's a good, that's a good picture. Uh, and so yeah, that, so you can find more information there.

Uh, and, uh, there's a contact form. com, uh, go check it out. Again, it's VC's gonna be part of the decision support offering.

So you get a whole bunch of stuff, access to the forums, you know, a bunch of symposiums. We do online training, uh, obviously the Ask the Expert, which is, you know, kind of the one-on-one interaction that you have with the faculty members. So it is, it is a pretty broad, uh, offering, you know, and, and VHC is really the latest of the value added capabilities that you can, uh, and that was totally, you know, random, right?

I mean, vendor assessment, community value added capabilities. And I did not do that on purpose. And I, and, um, I probably could never do that again cause that was more serendipity than anything else.

But, uh, Antoine Donor, thank you for joining us here on Text, on tv. Um, thanks Mike. Really appreciate the time.

com. Now let us send it back to the studio for our next interview. Thanks, Mike.