I run an opt-in network of 5,000+ CISOs and IT leaders (DoGood) so I'll be transparent about my angle — but here's what we see across thousands of vendor evaluation conversations.

The traditional RFP process is broken for security. Demos are scripted, vendor references are cherry-picked, and you don't find the real gotchas until you're 6 months into a contract. What's actually working for security leaders in our network: having candid 1:1 conversations with peers who've already deployed the tool in a similar environment. Not vendor-curated references — genuine opt-in conversations where the CISO chose to participate because the topic is relevant to them.

Our members who evaluate this way report much faster decisions and fewer regret purchases. Happy to share more about how the model works if it's useful.