We're being recommended a massive cybersecurity firm — is it overkill for us?

What exactly does the hospital's RFP say? Oftentimes enterprise buyers just want compliance with specific standards or an accredited body's report, without naming brands. If there's no brand requirement, going with the giant firm might be totally wasted money.

If you go with the giant corp, you get a fancy intro meeting with a corporate sales VP the first week and the next week an intern-level junior scans your system. Then when you want to ask a question, you sit around waiting for three days on a support portal.

We faced a similar dilemma in Valencia last year. We signed with an 8-person local team for 9.000 Euro. They handed us an extremely thorough 48-page report and hopped on calls directly with our dev to help close 4 critical vulnerabilities. We cleared the audit with zero issues.

I wouldn't trust boutique firms blindly. How much professional indemnity insurance do they carry? If one of your servers crashes or your database gets corrupted during testing, do they have the coverage to compensate for the damages? Small teams often cut corners on stuff like that.

Don't base your decision on price alone. Compare the firms on these three factors: 1) Is the scope purely automated scanning or does it include manual exploitation attempts? 2) Does the report provide an executive summary that non-technical management can actually understand? 3) Do they offer a free retest once the vulnerabilities are patched?

Talk to the boutique team and get written confirmation on whether they can strictly follow the report template required by the hospital. Also, to strengthen your case against the big firm, check if the boutique crew has staff with ISO 27001 lead auditor credentials.

dropping 52.000 Euro for an 18-person team hurts a lot. give the local team a chance imo if the vibe is right in the meeting and they give straight answers to your technical questions, go with them without a second thought.

I felt relieved reading this answer, so it's not just me. The answer varies greatly by industry; there is no one-size-fits-all rule.

Let me speak from the other side; I'm on the supplier side. Just because everyone does it doesn't mean it's right.

The real issue isn't the number, but what it's based on. If you have questions, write them; I'll answer as best I can.

We've heard this a lot, but it never happened like that for us. A small market isn't bad; working cheaply in a small market is.

If you get three different answers on a topic, the question was asked wrong. If you have questions, write them; I'll answer as best I can.

let me share what happened to me; it might be useful and a two-week notebook guiddes you more than a six-month forecast.

hasty decisions become decisions you have to fix six months later.. but correct me if I'm wrong.

Let me summarize the topic, since several different answers were given. Taking notes for two weeks yields better results than a six-month estimate.

Of course, it varies if your situation is different.

We need to take it step by step. The harder it is to reverse a decision, the slower you should make it.

Hope this helps.

I feel the same way. A small market isn't bad; working cheaply in a small market is.

I'm also curious if anyone does it differently.

Thanks that was the answer I was looking for.

We need to make a distinction here. Most time waste accumulates in tasks waiting for approval.

Finding a new customer is more expensive than keeping an existing one.

I'm writing this so you don't make the same mistake. Everything goes well for the first three months; problems arise in the fourth.

If you get three different answers on a topic the question was asked wrong. If you have questions write them; I'll answer as best I can.

I disagree with you on this point. The harder it is to reverse a decision, the slower you should make it.

That's all, sorry if I went on too long.