Questions to ask a security vendor's reference customers

A reference call is useful when you ask about what went wrong and how long it took, not whether the customer is happy. Ask for a reference that looks like you, prepare ten questions, and listen for specifics. Vague praise tells you the vendor chose a friendly customer.

Pick the right references

Vendors hand you their best accounts. You can still improve the odds:

• Ask for a customer with a similar stack, team size and deployment model.
• Ask for one who has renewed at least once. First-year enthusiasm fades.
• Ask for one who had a rough rollout and stayed. Their answers are the most useful.
• Ask for a contact on the engineering side, not only the executive sponsor.

If a vendor cannot provide a reference that matches your situation, record that as a data point in your scoring.

Rollout questions

1. How long from signed contract to the first team scanning in CI?
2. What did you have to build yourselves that you expected to be built in?
3. Which team resisted adoption, and what changed their mind?
4. What would you do differently in the first 30 days?

Listen for time estimates. "A few weeks" is a different answer from "one afternoon" or "two quarters."

Signal and noise questions

1. What share of findings do your developers act on today?
2. Did you tune rules or suppressions, and how much work was that?
3. When a result was wrong, how did you report it, and how long until it was fixed?

Do not ask for a precise false positive rate unless they track one. Most teams do not, and a made up number helps nobody. Ask how they would describe the trend instead.

Support and change questions

1. When did you last open a support case, and what happened?
2. Has the product changed in a way that broke your workflow?
3. How are changes announced, and do you get notice before behaviour changes?
4. Who do you talk to when something is wrong at the weekend?

Commercial questions

1. Did the price at renewal match what you expected from the first quote?
2. Did your usage metric grow faster than your team did?
3. Were there costs you did not see coming, such as extra seats for read only users or paid connectors?

These three alone can save a surprise at renewal. For how to compare quotes, see comparing quotes across pricing models.

The honest closing question

End with: "If you were choosing again today, would you pick the same tool, and what would make you leave?" Pause after asking. The silence is often where the real answer comes out.

Record and score the calls

Write notes the same day. Score each call against the same four headings: rollout, signal quality, support, commercial. Feed the result into your weighted rubric as evidence, not as a replacement for your own pilot. A reference reflects their environment, and your pilot reflects yours.

Quick check

Last reviewed: 19 October 2026.