What Should I Ask a Cybersecurity Company Before Hiring?

Every cybersecurity sales conversation feels the same at the start. It’s the honeymoon phase: new vendor, new dashboards, everyone’s excited. You hear about the monitoring, the alerts, the peace of mind. What you don’t hear enough about is what happens when things go bad. And they will go bad. I don’t know that anyone still claims a 100% success rate, and if a vendor does, that’s your answer right there.

I’ve had these conversations with a lot of prospects, and there are five questions I think separate a real security partner from a company that’s just selling you a package. They aren’t the questions most buyers think to ask. They’re the ones that matter. And if you’re still deciding whether to bring in outside help at all, start with the difference between in-house IT and managed IT services.

1. “What happens when things go wrong, and is remediation included?”

This is the one I’d lead with. Most conversations focus on setup, monitoring, and the exciting stuff. Almost nobody talks about what happens when there’s a real incident that takes weeks to work through, with meetings every single day, day in and day out.

It’s the same mature conversation good business partners have about recourse. Everyone talks about how great it’s going to be. Not enough people ask what happens if it isn’t. Ask directly: Does your service include helping us through the bad times, or does it stop at installing and monitoring? If it’s included, what does it cost?

Then ask the follow-up most people skip: Where’s the line between what you handle, what the software vendor handles, and what falls back on us? Endpoint protection is a good example. There are only a handful of platforms out there, and almost nobody is rolling their own anymore, so there’s always a three-way relationship between the customer, the MSP or MSSP, and the software vendor. (If you want the basics on that layer, I cover them in how to secure your endpoint devices and protect your data.) Be explicit and tell them to show you where that line is. If they can’t draw it clearly before you sign, that’s worth noting.

2. “Would you ever strip out a security layer to win a deal?”

You won’t ask this one out loud, but you can test for it. Watch how a vendor responds when you push on price.

I’ve seen this from the other side. We worked with a prospect who didn’t have enough respect for how bad a ransomware attack or other cybersecurity incident can get. To bring the cost down, they started pulling pieces out of our stack. Do we really need DNS security? Do we need remote access protection? Surely Macs don’t have these problems. We package our services deliberately, because the tools work together to observe, plan, patch, guide, and react if an attack happens. Strip enough of them out and you’re not saving money. You’re going back in time and asking for a problem.

We decided not to move forward with them, and we’ve used that as a standard ever since. If cost is the issue, let’s talk about how to negotiate and add value. But we won’t nickel and dime the toolset. The same test works from the buyer’s chair: if a vendor is willing to compromise the toolset just to win you, they’re probably the kind of company that moves fast and slams it in later. Then where are they when something happens and you ask about remediation? Both sides need standards.

3. “Will you help us through a compliance audit, or just hand us the paperwork?”

If you’re in a regulated space like HIPAA, SOC 2, or FINRA, this is the question that gets forgotten and bites you later. It ties back to remediation, but it’s specific: Are you there to help us fulfill the technical requirements and prove we’re compliant from the cybersecurity side, and will you help us navigate the audit?

Annual audits are common, and some mean regular meetings for a good while. Will they show up? Will they condense it into a weekly session where you send questions through and they answer? And the part that gets overlooked: is that support included, or is it an additional cost?

Compliance usually gets siloed off as an afterthought, unless you have a security officer who’s well organized. Even then, the security people, the compliance people, and the technical people all need to be talking to each other. Once you get into encryption at rest and in transit, authentication, and your identity provider, you’re into serious territory. You want a vendor who’ll help you through it.

4. “What do you actually do that a software reseller doesn’t?”

There are a lot of VARs and resellers who’ll help you get a discount on endpoint protection, email security, or DNS security and sell you a package. Those packages can look managed, but they’re built to help MSPs sell and grow. The companies behind them are software companies. They don’t have boots on the ground, and that’s a value a really good MSSP or MSP should be offering. For the businesses we work with across Atlanta, Charlotte, and Nashville, that on-the-ground support is a big part of the job.

So ask: When there’s an incident, what do you do? Do you interface with us directly, or are we left dealing with the software vendor on our own? If we’re running into a problem with that vendor, can you escalate for us? I’d expect a bat phone you can pick up to reach someone who can fix it.

And it isn’t only the catastrophic events. It’s the daily little things, like a user who looks like they’re logging in from the wrong place. Is that notification something your provider will address, or does it come from the vendor with a “hey, is this you?” that lands back on your desk? Play an incident through with them, step by step. You get the email, you analyze it, you look at our systems and tell us what’s going on, or you just pass it along to us. Do you even pass it along?

Here’s the kicker: with cybersecurity, you need all the value you can get out of everybody. The incidents are a non-stop deluge. A managed SOC is great. Someone who helps with remediation is great. Someone who’s been through an attack, can navigate it, and can tell you it’s not your fault is worth a lot, because you’re going to feel guilt and shame like you did something wrong. If you’re comparing providers more broadly, I also break down what to look for in a managed IT services provider.

5. “Can I talk to one of your clients, under NDA?”

This is the question I’d ask if I were the one shopping for a vendor, and it’s probably the boldest one on this list.

Here’s the problem. When someone breaks into your car, nobody blames you. But when someone breaks into your system and steals a million dollars through ransomware, you start to feel guilty, like you should have done more. Add real legal liability, and attorneys telling you to deny nothing and say nothing, and it’s no surprise most companies won’t share what happened to them.

So ask the vendor directly: I’m happy to sign an NDA with you and one of your clients. Is there one who’d talk to us about how you help with daily security incidents, or about how you supported them through a ransomware or cyber attack? If they don’t want to discuss an attack, that’s fine. Ask about their daily security routine, how the vendor reports to them, whether they’ve gotten time back, or just peace of mind.

It’s a very big ask, and maybe a little forward. But there’s nothing wrong with asking. A vendor who can connect you with a client, sealed with an NDA so neither side discloses anything, is telling you something no case study on their website ever could.

The bottom line

None of these questions are about catching a vendor in a lie. They’re about finding out, before you sign anything, whether the company across the table will be there when things go wrong and not only when everything’s going right. Ask about remediation. Ask where their responsibility ends and yours begins. Ask about compliance support, what they actually do during an incident, and whether they’re confident enough to let a client speak for them.

If a provider can answer all five clearly, you’ve probably found a real partner. If they can’t, or they get uncomfortable, that’s useful information too.

If you’re evaluating your options and want to see what managed detection and response looks like day to day, reach out to our team. I’m happy to walk through how we handle remediation, compliance support, and incident response before you make a decision either way.

FAQ

Brooks Snow is a co-founder of Renevar, a cybersecurity, compliance, and secure AI platform company serving small and mid-size enterprises. With backgrounds spanning software development, network infrastructure, data center operations, and security clearance-level compliance work, the Renevar team has been building secure, always-on systems since 2000.

This post was developed from an original interview with Brooks Snow, with AI assistance used for drafting and structuring. The insights, experience, and opinions are his own.