6 Reasons Why ‘Security Guarantees’ Are Good For The Security Community

 

Since Sentinel Elite was announced, we’ve experienced an exciting amount of interest in it’s money-back guarantee and $250,000 financial coverage for damages suffered if a customer is breached via a vulnerability that we should have discovered but missed. Over the last few weeks, the security community has been buzzing with chatter about software liability, cyber-insurance, and security guarantees. There is an opportunity here for the information security industry to up its game. When done right, security guarantees are going to be really good for the security community. Here’s why:

1. Truly effective security products become easier for customers to differentiate from those that are…less effective. Similar to how we look at the purchase of cars, electronics, and more, some products have better warranties than others, which signals less purchase risk for the buyer and an increase in perceived quality.
2. The credibility of the security industry, or individual vendor, is improved because we hold ourselves accountable for the performance of our products. Let’s face it. Security vendors don’t always have a great reputation when viewed by those outside the industry. One argument for why this is, is that when our advice or products fail, we’re not on the hook. Many vendors even profit when disaster strikes, yet the victims – our customers – are left cleaning up the mess. By making ourselves accountable in the event of a breach we can turn this perception around and prove that our goals do align with our customers.
3. We receive performance and actuarial data that can be directly used to increase the effectiveness of our products. The upside on having to pay-out on a failure to live up to a security guarantee is that we get hard data on what really went wrong. This data is helpful because it tells us why the security control didn’t stop the bad guy. This data is pure gold for product development.
4. It gives us the ability to quantify and convey the value of security products in dollars and cents. Most often business owners really don’t get the value of what it is that a security product does. We speak in esoteric terms about ‘vulnerability,’ ‘risk,’ ‘threat,’ ‘zero-day,’ and so on – very rarely do we speak in business terms or in dollars and cents that the business owner can truly understand. With security guarantees we can give stakeholders – those who pay for our solutions – a way to understand the value we bring to the business in language they understand and can plug into their financial spreadsheets.
5. The business interests of a security company are in line with the customer and decisions are made accordingly. One of the most frustrating things for a security professional is encountering situations when what a customer really needs to be more secure is not necessarily what is beneficial for the security vendor. Customers want to spend money on products that help them protect against getting hacked. When vendors provide security guarantees, the highest priority is doing exactly that, which creates a true partnership between the vendor and the customer.
6. Security guarantees enable defense-in-depth strategies to transcend the concept of simply buying multiple security products to protect the business in the event of financial loss. We know security products are not perfect or all-encompassing, so multiple solutions are needed to guard against breach under this eventuality. With a security guarantee, when all is said and done, the customer is still protected in the event that everything fails – which is more common than not these days.

We continue to appreciate the feedback on this topic and are very much interested in what our customers and the rest of the industry has to say about this. What other reasons are there – positive or negative – for having security guarantees? We would welcome your suggestions in the comments below.