Everyone pushes shiny dashboards and "single pane of glass" during sales. Reality is the first 90 days define whether a security tool gets used or becomes shelfware.
My template forces vendors to commit to concrete, measurable actions, not just features. It's built from getting burned by vague promises.
**Structure:**
* **Day 1-30 (Deploy & Baseline):** Focus on core data ingestion, agent stability (if any), and establishing a known-good baseline. No alerting yet.
* **Day 31-60 (Tune & Operationalize):** Enable primary detection use cases. Define and tune critical alerts. Integrate with ticketing.
* **Day 61-90 (Optimize & Validate):** Measure alert volume vs. true positives. Validate coverage against initial requirements. Finalize reporting.
**Template Excerpt (Days 1-30):**
```markdown
### Phase 1: Foundation (Days 1-30)
**Vendor Deliverables:**
- [ ] Provision tenant/instance in our region (EU-West-1)
- [ ] Deploy lightweight collector agent vX.Y.Z to 3 pilot servers (list provided)
- [ ] Ingest logs from pilot AWS account (123456789) and on-prem AD (dc01.contoso.local)
- [ ] Confirm log flow > 95% completeness for pilot sources for 72 consecutive hours.
**Success Criteria (Our Sign-off):**
- Agent CPU overhead < 3% on pilot servers (measured by our monitoring).
- Log ingestion latency < 60 seconds (p95).
- No critical or high-sev alerts generated by vendor system (intentional quiet period).
```
The key is tying their success criteria to *our* independent metrics (our monitoring, our log sources). Stops them from blaming our environment when their agent is a hog.
Full template is in the gist. Tear it apart. What's missing? What vendor tricks does it still let through?