How We Choose a Security Vendor: A No-Nonsense Guide

We have sat through enough vendor pitches to know that the slickest demo rarely means the safest product, so here is how we actually evaluate security partners. Over the years we have watched polished slide decks promise “military-grade encryption” while the vendor’s own ICO registration lapsed, and we have seen quiet, unglamorous suppliers pass every penetration test we threw at them. This guide sets out the process we follow at sol-pass.com before we let anyone near our authentication stack, our customer data, or our digital identity roadmap. It is not glamorous, but it works.

Start With Your Own Threat Model, Not Their Sales Deck

Before we take a single meeting, we write down what we are actually protecting and who wants it. That means mapping our cyber threats, our data flows, and our legal obligations first. The National Cyber Security Centre (NCSC) provides UK-specific vendor and supply chain guidance, and we treat it as our starting checklist rather than relying on a vendor’s own risk summary. A supplier cannot tell us whether their product fits our risk profile if we have not defined that profile ourselves.

Mapping Your Attack Surface and Data Flows

We draw the diagram before the demo. Where does customer data enter our systems? Which third parties touch it? What happens when a member of staff leaves and their credentials linger in a SaaS tool nobody remembers buying? We list every external dependency, every API call, and every place a token or session could be hijacked. Cyber Essentials, the UK government-backed certification scheme, is useful here because its five technical controls force us to answer basic questions about firewalls, patching, access control, malware protection, and secure configuration across our whole estate, including supplier connections.

Regulatory Duties: UK GDPR, DPA 2018 and Sector Rules

UK GDPR and the Data Protection Act 2018 impose breach notification and data handling duties that do not disappear because we outsourced a function. If a vendor processes personal data on our behalf, we remain accountable. We note our 72-hour breach notification window, our Article 28 processor contract requirements, and any sector-specific rules such as FCA guidance for financial services or NHS DSPT requirements for health data. A vendor who cannot explain their own breach notification process in plain English fails at this stage.

What We Actually Check Before Shortlisting a Vendor

Once a supplier survives the threat-model conversation, we run practical due diligence. This is where marketing claims meet paperwork, and the paperwork usually wins.

Certifications and Independent Audits

We ask for evidence, not logos. Our standard shortlist checks include:

• ISO 27001 certification, including the scope statement and the certification body’s name, so we can verify it is current
• SOC 2 Type II reports covering security, availability, and confidentiality, with a look at the auditor’s opinion and any exceptions noted
• Penetration test summaries from the last twelve months, ideally with remediation evidence for high and critical findings
• Cyber Essentials or Cyber Essentials Plus certification where the vendor handles UK public sector work
• Confirmation of the vendor’s status on the ICO register if they process personal data

A vendor who cannot produce a SOC 2 Type II report but offers a “security overview PDF” is telling us something important about their maturity.

Breach History and Incident Transparency

We ask directly: have you been breached, and what happened? We are less interested in the fact of a past incident than in how it was handled. Did they notify affected parties within the legal window? Did they publish a post-mortem? Did they fix the root cause or just the symptom? A vendor with a disclosed, well-handled incident is often safer than one with an unblemished record and no incident response plan we can inspect.

Financial Stability and UK Support Presence

A security vendor that folds next quarter is a data residency and continuity problem. We review filed accounts, funding runway, and ownership changes. We also check whether they have UK-based support and data residency options, because routing our authentication traffic through a single overseas region adds latency and legal complexity we would rather avoid.

Authentication and Digital Identity: Where Vendors Often Fall Short

This is our home turf, so we scrutinise it hardest. Authentication is where convenience and security collide, and plenty of vendors quietly prioritise the demo over the threat model.

Passwordless Readiness: FIDO2 and Passkeys

FIDO2 and WebAuthn are key standards for passwordless authentication, and we treat genuine support for them as a baseline, not a bonus. We test whether passkeys work across platforms, whether the vendor supports hardware security keys, and whether fallback methods quietly reintroduce SMS one-time codes as the weakest link. We also benchmark against GOV.UK One Login, the UK government’s digital identity programme, which has pushed passwordless and identity assurance expectations forward across the public sector.

Identity Proofing and KYC Standards

If a vendor claims to verify identity, we ask which assurance framework they map to and how they handle document liveness, deepfake injection attacks, and synthetic identities. We want to see how they align with UK AML requirements and whether their identity proofing can be independently audited.

Single Sign-On and Directory Integration

We check SAML, OIDC, SCIM provisioning, and how cleanly the product integrates with Entra ID, Okta, or Google Workspace. Clunky directory sync creates orphaned accounts, and orphaned accounts are a cybersecurity problem waiting to happen.

Interoperability, Lock-In and the Exit Plan

A vendor who makes leaving painful is a vendor you should hesitate to join. We treat exit planning as part of onboarding, not an afterthought.

Open Standards Versus Proprietary Formats

We favour vendors who expose documented APIs, support standard identity protocols, and let us export user data, logs, and configuration in usable formats. Proprietary token formats and closed SDKs are red flags unless there is a compelling, well-justified reason.

Contract Terms, SLAs and Termination Rights

Under UK law, we want clear termination for convenience, defined data deletion timelines, and service level agreements with meaningful remedies. We read the exit clause before the pricing page, every time.

Piloting and Scoring Vendors Like We Mean It

No vendor signs a contract without surviving a pilot. We run limited deployments against real cyber threats, not scripted demos.

Designing a Fair Proof of Concept

We define success criteria in advance, use real (anonymised) data, and test failure modes such as revoked credentials, expired tokens, and simulated phishing against the authentication flow.

Weighted Scorecards and Stakeholder Sign-Off

We score vendors across security, usability, support, cost, and exit risk, with weights agreed by IT, legal, and the business. No single department gets a veto, and no vendor gets a pass because the demo looked good.

FAQ

Do we need Cyber Essentials to choose a security vendor?

Not strictly, but Cyber Essentials is a UK government-backed certification scheme relevant to vendor selection, and asking whether a supplier holds it tells you a lot about their baseline hygiene. For public sector work it is often mandatory.

How much weight should we give ISO 27001 versus SOC 2?

Both matter. ISO 27001 shows a certified management system, while a SOC 2 Type II report shows tested controls over a period. We ask for both where possible and read the scope carefully.

Is passwordless authentication actually ready for mainstream business use?

Yes, if the vendor genuinely supports FIDO2 and WebAuthn rather than bolting passkeys onto a password-first system. GOV.UK One Login has helped normalise this expectation in the UK.

What is the biggest red flag in a vendor contract?

Vague or punitive exit terms. If data portability, deletion timelines, and termination rights are not clearly defined, we walk away regardless of how good the product looks.

The best security vendor is the one that fits our risk profile, proves its claims with evidence rather than adjectives, and lets us walk away without holding our data hostage. Everything else is just a good demo.