Killing a Tool: The Murder Board Nobody Runs
Security teams buy well and retire badly, which is how a stack reaches thirty tools. A murder board is the two-hour structure that makes a retirement decision defensible before it happens.
Buying & Evaluation
A security purchase crosses more internal boundaries than almost any other software buy, and almost nobody writes about it from inside the room. This desk covers the mechanics: who is really in the committee, what triggers a budget line, whether a POC earns its cost, how questionnaires get used as a weapon, and how to retire a tool without leaving a hole.
8 pieces
Should You Run a POC or Trust the Reference Call?
A proof of concept costs weeks of engineering time you are not accounting for. Two good reference calls cost ninety minutes. The choice turns on one question: is the failure you care about visible from outside?
The POC Scorecard: 14 Criteria That Predict Production Behavior
Most POCs are scored on whether the product worked. That is the wrong question, because the vendor configured it. These fourteen criteria are the ones that predict month twelve.
How to Run a Security Evaluation That Actually Decides
Most security evaluations do not end in a bad purchase. They end in no purchase, six months later, with nobody able to say what happened. The failure is procedural, and it is fixable in the first two weeks.
The Security Questionnaire Is a Sales Weapon, Not a Compliance Chore
Vendors treat questionnaires as overhead. Buyers treat them as diligence. Both readings are wrong: a questionnaire is the cheapest way one side of a deal shifts work onto the other.
The Engineer Who Killed Your Deal Was Never on a Call
The most consequential opinion in a security evaluation is usually formed in a private message by someone the vendor never met. Both sides of the deal should understand how that works.
The 30-Day Security Tool Rationalization Playbook
58% of organizations run more than 25 security tools. This is the four-week program for finding the overlap, deciding what goes, and freeing budget without creating a hole.
What Actually Triggers a Security Budget Line
New security spend is almost never caused by a persuasive case. It is caused by an event with a date on it. Knowing which five events do it changes when you ask, not how.
Benchmarks on this desk
58%
of organizations run more than 25 security tools
Wiz · August 28, 2026
5 to 16
people in a B2B buying group, across up to four functions
Gartner · August 28, 2026
67%
of B2B buyers prefer a rep-free buying experience
Gartner · August 28, 2026
74%
of B2B buying teams show unhealthy conflict while deciding
Gartner · August 28, 2026
48%
of breaches involved a third party
Verizon · August 28, 2026
Tools
- Security Tool Overlap Analyzer
Enter your stack, see which tools cover the same control, and get an estimate of the spend sitting in the overlap.
- POC Scorecard
Score a vendor POC against fourteen weighted criteria, see the shape rather than just the total, and export a defensible summary.
Common questions: buying
- How many people sit on a security buying committee?
- Gartner's published range for a modern B2B buying group is five to sixteen people across as many as four functions. No analyst publishes a separate figure for cybersecurity specifically, and the widely repeated eight-to-fifteen claim is a third-party synthesis rather than measured data. Security purchases sit toward the upper end structurally, because the tool pulls in legal, procurement, privacy, and an architecture reviewer.
- Who actually kills a security deal?
- Most often a technical evaluator who never appears on a sales call. Security engineers and architects are asked for a private read on a product, they answer honestly in an internal channel, and the deal dies without the vendor ever hearing why. The economic buyer signs, but the technical evaluator holds the veto.
- Is a proof of concept worth running for every security tool?
- No. A POC earns its cost only when the failure mode you care about is invisible from outside: performance under real data volume, integration friction, or operational noise. For anything a reference customer can describe accurately, two well-chosen reference calls are faster, cheaper, and produce a better signal than a rushed thirty-day trial.