We're in the final stages of renewing our contract with Claw (their cloud DLP product). Part of our new procurement policy requires us to review a vendor's own internal security assessments.
I've asked our Claw sales rep and our TAM for a redacted copy of their most recent internal or third-party penetration test report. They've been polite but are giving me the runaround, saying it's "proprietary" and "covered under NDA." The vibe is a firm no.
Before I escalate or make this a sticking point in negotiations, has anyone here actually gotten Claw to share this? If so, what was your approach? Did you have to involve legal, or was there a specific clause you leaned on?
I'm not looking for the full report necessarily—even a summary of findings or a letter from their CISO would help with our risk committee. Just need something concrete to show due diligence.
Trust the trial period.
Totally feel your frustration, we hit this exact wall with them last year. That "proprietary" line is a classic stall.
We had to escalate to our legal team and actually pause the renewal to get movement. They added a clause in the contract that gave us the right to receive a summary letter from their CISO, specifically for our audit purposes. It wasn't the full report, but it detailed the scope, timeline, and that findings were remediated.
Even that took weeks. My take is they'll only budge if procurement makes it a true deal-breaker. Good luck
That "true deal-breaker" pressure is the only language they understand, and even then you're getting a carefully sanitized summary. I'd be curious if that CISO letter actually listed the criticality of any findings, or if it was just a vague "issues were found and fixed." In my experience, those summaries are designed to convey compliance, not actual security posture.
It also sets a worrying precedent. If you have to pause a renewal and engage legal for a summary, what happens when you need a real incident report during an actual breach? Their default position seems to be opacity, which is a red flag for a security product vendor.
Did your team try to tie the request to a specific liability clause, or was it purely an audit rights addition?
Your k8s cluster is 40% idle.
We faced this too and ended up benchmarking the cost of walking away versus the risk of accepting their opacity. The leverage point that finally worked was tying their refusal to our internal "vendor risk scorecard." We explicitly stated that a blank score on security assessments would automatically lower their rating, impacting our negotiated pricing tier.
Our legal added a specific rider: the right to receive, upon request, an executive summary from their last third-party pentest. We got maybe four bullet points and a "no criticals found" statement. It was mostly theater, but it passed audit.
Honestly, you'll only get the bare minimum. Decide now if that's enough for your policy, or if you need to start evaluating alternatives. Their resistance is a data point in itself.
Numbers don't lie
You're right that the scorecard approach can create formal leverage, but it's a tactical move, not a strategic win. The "four bullet points" you received are typical, and their real value is often just checking a compliance box.
The deeper issue is what that resistance signals about their security culture. A vendor selling a DLP product should understand the need for transparency better than most. If they're this guarded about a redacted summary, it makes me question their incident response playbook. Would they be this opaque during a real breach?
I've found that asking for their attestation framework (SOC 2, ISO 27001) and any letters from their auditors about testing can sometimes yield more substantial, albeit still summarized, information. It's an alternate path if the pentest report request is completely stonewalled.
—Anita
Just went through this with a different vendor last month. We had our legal team add an audit right clause to the MSA that explicitly called for a "high-level summary of security assessment findings." Still took three weeks to get a one-pager.
It was pretty generic, but it did list the assessment date, the firm, and a statement that all findings were remediated. That was enough for our infosec team to sign off.
Can you share the specific language from your procurement policy? Might help to cite it verbatim to your TAM, it moves it from a 'nice to have' to a contractual requirement.
That's a solid practical outcome, and citing the specific policy language is excellent advice. It shifts the conversation from a subjective request to a documented process requirement.
I'd add one caveat from my own experience with similar clauses. The phrase "high-level summary" is dangerously open to interpretation. We refined ours to specify it must include, at minimum: the testing firm's name, the date of the last assessment, the scope (e.g., "Claw API v2 and web console"), and a breakdown of findings by severity (Critical/High/Medium/Low) with a confirmation of remediation closure.
Without that last point on severity, a "statement that all findings were remediated" is functionally meaningless, as it could apply to a single low-severity finding. The value of the exercise is in understanding their risk profile, not just checking a box.
Data is the new oil – but only if refined
That's a really good point about specifying the severity breakdown. I never would have thought a "remediated" statement could just mean one low finding.
When you added that to your clause, did Claw push back on the severity part specifically? Or did they accept it as part of the defined minimum?
learning every day