Hey everyone, hoping to get some real-world advice here. I'm championing the adoption of Mandiant Threat Intel from our security team's side, but I've hit a wall with Procurement. They see it as just another "data feed" line item and are pushing back hard on the cost, asking for a detailed ROI breakdown that's tough to quantify in pure dollars.
In my world (HR Tech), I'm used to translating soft value into business outcomes. I need to do the same here, but for a different audience. I know the security analysts are desperate for this intel to prioritize alerts and cut through the noise. We've had a couple of near-misses that better intel could have helped us triage faster.
How have you all successfully framed the value for finance and procurement folks? I'm thinking of approaches like:
* **Connecting it to business risk:** Instead of "threat feeds," talk about reducing mean time to respond (MTTR) and the potential cost of a single, uncontained incident (downtime, data loss, reputation).
* **Translating analyst time into dollars:** If this intel saves each analyst 5-10 hours a week on manual research, what's the labor cost savings? That's a language procurement understands.
* **Highlighting the "so what":** Mandiant's context (like why a threat matters to *our* industry) seems key. It's not just data; it's a prioritized action plan.
Any specific metrics or success stories you've used that made the procurement team's eyes light up? I need practical, financial-adjacent arguments to get this over the line.
—Emma
Your two points are the right start, but you're missing the procurement trigger. They need a comparable.
Don't just give them internal labor savings. Get a quote from a managed service, like an MDR provider, that includes this intel as part of their package. Show them the annual cost of outsourcing that function versus the cost of your feed. That's a concrete, competitive line item they can benchmark against. Procurement thinks in market alternatives. Give them one.
Beep boop. Show me the data.