guides5 in this area
proving it with a POC.
A POC answers whether the product works. Whether anyone buys it is settled elsewhere: in the success criteria, in who signs them, in the security review that runs beside the test, and in who runs the evaluation. Start with the first guide, then read the others in the order of your next evaluation.
- 01before you agree to a POC2 guides
- 02while the POC runs1 guide
- 03when a partner runs the POC2 guides
- 04when the buyer is a public authority2 guides
The reasoning behind this order: trust transfer, the thesis behind the site.
read them in this order.
before you agree to a POC
- 01how to run a security POC that ends in a decisionA POC answers whether the product works. Who buys it, with which budget and by when is a separate question. How to set up an evaluation so the last meeting is a decision.
- 02free trial, POC or paid pilot: which evaluation to offer a security buyerA trial proves the product works, a POC proves it works in their environment against agreed criteria, a paid pilot proves they will buy. How to choose the format for the next evaluation request, and how to move a buyer from one to the next.
when a partner runs the POC
- 04your POC is run by someone you don't pay: partner-run POCsIn much of Europe a distributor's or integrator's engineer runs the evaluation of your product. How to keep visibility, quality and learning when your own engineer is not in the room, who pays for the partner's time, and what to measure.
- 05co-selling with a partner: who owns what in the dealEvery partner wants your engineer in front of its customer. Your engineers' time is the scarcest thing in the channel. How to ration co-selling with rules partners accept, split the roles in a co-sold deal, and move partners towards selling without you.
when the buyer is a public authority
- 06a POC inside a public tender: what procurement law allowsA public buyer can test your product before it buys, but only in ways open to every bidder. What Directive 2014/24/EU and the Polish Pzp allow before and during a procedure, and how to run a demonstration that can be scored.
- 07why a vendor with the better product loses a Polish tenderIn a Polish public tender the decision is made months before the bids, in the specification. After publication, the better product is the one that fits the specification at the lowest price. How the system works, what the numbers say, and where a vendor can still act.
tools for this area.
questions these guides answer.
How long should a security POC take?
Public guidance clusters around two to eight weeks for a POC or proof of value. GitLab designs its evaluations around 30 days with a check at day 15. Start the clock on the first day evaluators can work.
What are success criteria in a POC?
Written statements of what the evaluation must show for the buyer to proceed. Good ones are few, measurable, have a baseline, a target and an evidence source, and are approved by the people who will make the decision before the POC starts.
Should a vendor charge for a POC?
A fee is a fair counter-offer when the buyer wants a large evaluation without agreeing what success leads to. It confirms a budget exists and exposes the paper process early. In public sector deals a paid pilot can trigger procurement rules, so check before offering one.
When should a vendor start the buyer's security review?
At the same time as the technical evaluation, not after the business decision. A review started late sits on the critical path, and an uncertain buyer gets a respectable reason to wait.
More in the security review is a second evaluation. start it with the POC
Does a SOC 2 report or an ISO 27001 certificate prove a product is secure?
No. A SOC 2 Type 2 report tests whether controls operated over a period, a Type 1 report only assesses their design at a point in time, and an ISO/IEC 27001 certificate says a management system meets the standard within a stated scope. None of them tests the buyer's own configuration.
More in the security review is a second evaluation. start it with the POC
Security Revenue · every Tuesday
How security vendors build pipeline.