Procurement is a function with its own mandate and its own scorecard. Its people are measured on savings, cost avoidance, the share of spend they control, supplier risk and policy compliance. Find out which of those your buyer owns, and you can predict most of their behaviour. Then give them a saving they can report without moving your walk-away point, answer the risk questions before they’re asked, and plan supplier onboarding as part of the close.
procurement rarely picks the product
In most security purchases the business owner, usually the CISO or the head of IT, chooses the solution and owns the budget. Procurement runs the commercial process, protects the organisation from supplier risk and negotiates the terms. Forrester reported in its 2026 State of Business Buying research that procurement is a decision maker in 53% of B2B purchase cycles and is involved from the beginning.
That makes two common mistakes expensive. Treating procurement as the enemy, and going around it through the CISO or your own CEO, usually works once. Procurement remembers, and it will run the renewal. Treating procurement as the decision maker, and pitching it on product value, wastes time. Procurement is unlikely to defend a premium price on value grounds. The business owner might.
what procurement is measured on
| Metric | What it means for your deal |
|---|---|
| Hard savings | The gap between an old and a new price. Often tied to the negotiator’s bonus. The source of “we need to show a saving against last year” |
| Cost avoidance | A future cost prevented, such as a capped renewal uplift. Many teams value it less than hard savings, which is why a buyer may push harder on headline price than on a renewal cap worth the same |
| Spend under management | The share of spend procurement controls. Software bought on cards is a priority target |
| Compliance | Approved suppliers, three quotes above a threshold, a valid contract and purchase order |
| Supplier risk | Financial stability, security, data protection, continuity. For a security vendor, this part gets the most scrutiny |
The CIPS list of procurement KPIs covers these in more detail. The one that matters most is how the buyer calculates savings. If savings are measured against your first quote, an inflated first quote followed by a large discount “creates” savings on paper. If they are measured against last year’s price or an external benchmark, the first quote doesn’t help anyone. Ask.
where your product sits in their portfolio
Peter Kraljic’s 1983 Harvard Business Review article gave procurement a portfolio tool still taught today. It sorts purchases by their impact on the business and the risk in the supply market. The quadrant your product lands in largely decides what kind of process you’ll face.
seen as a leverage item
high impact, many interchangeable suppliers
- Frequent competition, tenders, sometimes e-auctions
- Price is the main lever
- Typical for resold licences of a widely available product
seen as strategic or a bottleneck
few credible suppliers, real switching cost
- Longer agreements, a supplier relationship, continuity terms
- Risk and fit matter more than unit price
- Requires a business owner who can say why you aren't interchangeable
standard tactics, and a response that doesn’t involve lying
Most tactics sellers complain about are legitimate tools for testing whether the first offer is the best available. One pattern works for almost all of them:
- Acknowledge the request without accepting its premise.
- Test the claim with questions an honest counterpart can answer easily.
- Trade instead of conceding. Any price movement is exchanged for something: term, volume, payment timing, scope, a reference, a signature date.
- Hold the walk-away point you set before the meeting.
| Tactic | Test it with | Trade or respond with |
|---|---|---|
| “We only have budget for X” | How was the budget set, before or after the scope was known? Can it split across fiscal years? | Reduced scope, a phased purchase, or the cost of the gap in business terms |
| “Your competitor is 30% cheaper” | What is included: modules, users, support, implementation, term, renewal protection? Is it acceptable to the CISO? | A like-for-like comparison. Never claim to know their price |
| “Final number by Friday” | What drives the date: a board meeting, year-end, an expiring contract? | A concession in exchange for the signature date they need |
| “Best and final offer” | Is it truly final? Does the award follow directly? Is there a contract negotiation after? | A decision, made before the round, on how much concession to hold back |
| “We need 15% off last year” | How is the saving calculated? | The saving in a form that counts: a longer term, a renewal cap, a bundled service |
| Small extra requests after agreement | A written list of open items, each traded, and closed explicitly |
Don’t mirror pressure with invented deadlines, invented scarcity or claims about other customers’ prices. Declining to disclose your floor is normal negotiation. Inventing facts is not, and it surfaces at the next renewal.
give procurement a win it can report
Procurement needs a story for its own scorecard. Structure the offer so the saving is real and documentable: a lower unit price for a longer term, a cap on renewal uplifts, a health check or training included at no charge. You help the negotiator win internally without touching your walk-away point. And keep the business case with the business owner, where the value argument belongs.
the close that slips after “yes”
Before a large organisation can pay a new supplier, the supplier has to exist in its vendor master data. For a security vendor, that usually means more than a form.
- 1registrationSupplier portal, legal entity, tax identifiers, contacts.
- 2bank verificationOften a separate call-back or bank letter. Strict for a reason: the FBI's IC3 received 21,442 business email compromise complaints in 2024, with about USD 2.77 billion in reported losses.
- 3risk and compliance checksSanctions, anti-bribery, financial checks, beneficial ownership.
- 4security and data protection reviewQuestionnaire, certifications, penetration test summary, data processing agreement, sub-processors.
- 5insurance and commercial setupCertificates, payment terms, purchase order and e-invoicing requirements.
Ask early whether you, or the partner reselling for you, are already registered. If the buyer already has a registered reseller or distributor, buying through it can skip onboarding a new supplier entirely. Keep a current supplier pack ready: registration documents, tax certificates, bank letter, insurance certificates, security certifications, standard questionnaire answers, data processing agreement and sub-processor list. And put every onboarding step in the mutual plan, with owners and dates on both sides.
payment terms are a trading variable
Payment terms carry real cash value, and procurement often owns them as a policy. In the EU, the Late Payment Directive sets 30 days after the invoice as the default between businesses, and caps contractual periods at 60 days unless expressly agreed and not grossly unfair to the supplier. Annual upfront billing, net days and the billing trigger, whether signature, go-live or acceptance, are all things you can trade. A small discount for upfront payment of a multi-year term may be worth more to you than the same discount is to them.
the question for your sales team
In your last three deals that slipped a quarter, how many slipped in negotiation, and how many in onboarding?
questions
Does procurement decide which security product wins?
Rarely alone. In most technology purchases the business owner, such as the CISO, picks the solution and owns the budget. Procurement shapes the commercial terms, runs the process and reviews supplier risk. In organisations with strong category management it can redirect a selection, especially for products it sees as interchangeable.
How should a seller respond to 'your competitor is 30% cheaper'?
Test whether the quotes are comparable: modules, user counts, support level, implementation, term length and renewal price protection. Ask whether the business owner considers the alternative acceptable. Then trade rather than concede, and never claim knowledge of a competitor's pricing you don't have.
What are standard B2B payment terms in the EU?
Under the Late Payment Directive, the default between businesses is 30 days after the invoice when the contract sets no period, and contractual periods should not exceed 60 days unless expressly agreed and not grossly unfair to the supplier.
sources
Security Revenue · every Tuesday
How security vendors build pipeline.