Signed

You got three quotes, pushed all three vendors, and took the one with 20% off. That process compares price on the basics every platform shares and hides what actually decides the purchase: whether the platform fits your business, and what the service really costs to deliver. Max explains why the three quote rule breaks down for enterprise technology and why a discount off the industry's opening price can still leave you overpaying.What You'll LearnHow to tell whether three vendor quotes are actually comparableWhat to define before you ask any vendor for a quoteWhy one vendor can quote far below the othersHow platform owners and resellers price differentlyWhen support is worth more than another 5% offWhy a 20% discount can still leave you overpayingAnswer These Before You Request QuotesWhat does this have to do that's specific to your business? Every phone system makes and takes calls. Write down what you need after that, like the systems it has to connect to and the hardware you plan to keep. That list is what makes the quotes comparable.Why is each vendor on your list? If the honest answer is "they were the ones we'd heard of," the comparison was decided before it started. Build the list from your answer to the first question.Does the vendor build the platform or resell it? A vendor that runs its own platform works from different costs than one reselling it wholesale. Ask each vendor which one they are, because it changes how far they can move on price.What will your team handle that the vendor won't? If your users are spread across locations, someone has to set things up on site and help people when something breaks. Price that work before you compare quotes. Another 5% off won't cover it if your team ends up doing the vendor's job.What price did every quote start from? Vendors in a category tend to open near the same list price. A 20% discount from that number tells you the vendor was willing to move. It doesn't tell you the price is competitive.If you can't answer two of these in writing, three quotes won't tell you which vendor to pick. Max walks through why in the episode.The Playbook(00:00) - Why “get three quotes” is dangerous advice for enterprise tech (00:59) - When price shopping actually works (01:42) - Same core features, very different platforms (02:41) - Why one vendor can sell so much cheaper (03:37) - Why platform owners and resellers price differently (04:05) - When support is worth more than another 5% off (04:35) - Why 20% off a $25 seat can still mean overpaying (05:33) - What three quotes will never show you Resources MentionedUnified communications (UCaaS): https://www.itbroker.com/solutions/unified-communications-as-a-serviceFurther reading, You Have Three Vendor Quotes. Here's What You're Still Missing Before You Sign.: https://www.itbroker.com/blog/how-to-compare-it-vendor-quotesAbout Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcomFull Transcript Click here to view the episode transcript.

Before you compare a single vendor, a lot of the decision is already made. The systems you run today rule some platforms out, and the choices you make now decide whether a requirement three years from now means adding a license or replacing something the business runs on. In this Playbook, Max Clark, CEO of ITBroker.com, answers a question he was asked directly: which is harder, brownfield or greenfield? Brownfield means building on systems you already have. Greenfield means starting from nothing. Max walks through why your existing setup narrows your options more than any feature comparison or RFP, what to plan for when you're starting fresh, and why each situation needs its own approach.What You'll LearnHow to tell if a new platform will work with the systems you already runHow your existing technology narrows your vendor options before you compare themWhat to plan for when you're choosing IT infrastructure from scratchHow to plan infrastructure for the next three to five years of business growthHow to avoid buying technology you'll have to replace laterWhy brownfield and greenfield projects need different buying approachesAnswer These Before You Compare VendorsWhat does a new system have to work with? List the hardware you plan to keep and the platforms it has to connect to, like Microsoft 365 or Google Workspace and your CRM. A vendor that can't support something on that list is either out or carrying a replacement cost.Which of those are you willing to replace? Some older equipment is worth replacing anyway. Decide that before the demo, so it's in the vendor's price instead of showing up during the rollout.What does your business plan say about the next three years? New locations and new compliance requirements change what your platform has to support. Write them down while they're still plans.If one of those happens, is it a license or a rebuild? Ask this about every platform you're considering. A feature you can turn on is a line item. A core system you have to replace is a project.If you can't answer two of these in writing, you're not ready to compare vendors yet. Max walks through both sides in the episode.The Playbook(00:00) - The three year test: add a license or replace a core system (00:32) - Why existing systems make vendor selection easier (01:32) - Why your current setup matters more than the RFP (02:31) - Starting from scratch: decisions that last five to seven years (02:59) - How your industry shapes what you'll need next (03:55) - Why neither approach is easier Resources MentionedMicrosoft 365 and Google Workspace, Max's first example of a decision that already limits which platforms fitSalesforce and HubSpot, the CRM choice that shapes what you can layer on top of itUnified communications (UCaaS), the phone system category in Max's example of checking a new platform against the hardware you already ownAbout Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcomFull Transcript Click here to view the episode transcript.

Steve Wilson built his own AI assistant the careful way. He gave it its own Google account and read only access to his calendar, and told it not to talk to strangers. His company's CISO had a pen testing team go after it, and 4 days later the assistant reported that it had compressed his source code and attached it to a meeting with an outside consultant. A fake email from a lookalike domain, written as if it came from Steve, was all it took.Steve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He joins Max Clark to break down what AI agents are already doing inside companies, who is responsible for them, and what to check before you approve one.They get into why an agent using an employee's login is its own identity, why you can't filter prompt injection out, why blocking AI tools only sends people around IT, and what Steve's forecast of 10x the digital workers and 10x the attacks means for security teams.If nobody at your company can say which AI agents are running and who answers for them, this episode starts there.What You'll LearnWhat are the biggest security risks of AI agents inside a company?How do we know what AI agents our employees are running?Should an AI agent use an employee's login, or have its own identity?Who is responsible when an AI agent does something it shouldn't?Can an AI agent be tricked into leaking company data?Can you stop prompt injection with a filter?Should we block employees from using AI agents, or approve one and manage it?Can AI help a security team, and what does it do in the first minute of an alert?In this conversation:(00:00) - Intro (00:44) - What an AI agent does in the first minute of a security alert, so a human starts with a finished investigation (11:51) - Steve's two-year forecast: 10x more digital workers on your network, 10x more sophisticated attacks, 100x the data to sort through (19:30) - Insider threats now include AI agents that malfunction or go off course (37:41) - Blocking AI just sends people around you. Approve one tool and manage it instead (44:04) - The three kinds of AI agent in your company, and why you can't filter prompt injection out (49:32) - Who owns an AI agent: security, IT, the business, or the employee who built it (56:10) - He gave his AI assistant its own identity and limited access. It still got phished (01:02:44) - Shadow AI spreads faster than shadow IT, and your approved tool gets abandoned (01:22:53) - Why AI won't shrink your security team, and the entry-level hiring gap it leaves (01:31:48) - AI is moving back in-house, and what that changes for security What We MentionedThe Developer's Playbook for Large Language Model Security (O'Reilly). Steve's book. It lays out what can go wrong when AI is built into products and how to defend against it, drawing on the 400+ experts behind the OWASP Top 10 for LLMs. It is written for developers and security teams, and it is the plain language reference if AI agents already have access to your systems.OWASP Gen AI Security ProjectOWASP Top 10 for LLM ApplicationsExabeamExabeam Nova, the AI agent built for security operations centersOpenClaw, the open source AI agentClaude CodeClaude CoworkOpenAI CodexMCP (Model Context Protocol), the way software lets AI agents use itSalesforceMicrosoft SharePointOktaCrowdStrikePalo Alto Networks CortexMicrosoft SentinelDropbox, Steve's early example of shadow ITSOC (security operations center)SIEM (security information and event management), the central system that collects security dataMSSP (managed security service provider)MDR (managed detection and response)EDR (endpoint detection and response)Prompt injection (hidden instructions an AI follows as if they were yours)Pen testing (authorized attacks used to test your defenses)About Steve WilsonSteve Wilson is Chief AI and Product Officer at Exabeam and founder and co chair of the OWASP Gen AI Security Project. He wrote the first OWASP Top 10 for large language models and the O'Reilly book The Developer's Playbook for Large Language Model Security.Steve Wilson on LinkedIn | Steve Wilson on X | Exabeam | Exabeam on LinkedIn | OWASP Gen AI Security Project | OWASP Gen AI Security Project on LinkedInAbout the ShowSigned is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast.If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com.Buy tech without regret.Follow: @itbrokerdotcomFull TranscriptClick here to view the episode transcript.

Before you compare a single vendor, a lot of the decision is already made. The systems you run today rule some platforms out, and the choices you make now decide whether a requirement three years from now means adding a license or replacing something the business runs on. In this Playbook, Max Clark, CEO of ITBroker.com, answers a question he was asked directly: which is harder, brownfield or greenfield? Brownfield means building on systems you already have. Greenfield means starting from nothing. Max walks through why your existing setup narrows your options more than any feature comparison or RFP, what to plan for when you're starting fresh, and why each situation needs its own approach.What You'll LearnHow to tell if a new platform will work with the systems you already runHow your existing technology narrows your vendor options before you compare themWhat to plan for when you're choosing IT infrastructure from scratchHow to plan infrastructure for the next three to five years of business growthHow to avoid buying technology you'll have to replace laterWhy brownfield and greenfield projects need different buying approachesAnswer These Before You Compare VendorsWhat does a new system have to work with? List the hardware you plan to keep and the platforms it has to connect to, like Microsoft 365 or Google Workspace and your CRM. A vendor that can't support something on that list is either out or carrying a replacement cost.Which of those are you willing to replace? Some older equipment is worth replacing anyway. Decide that before the demo, so it's in the vendor's price instead of showing up during the rollout.What does your business plan say about the next three years? New locations and new compliance requirements change what your platform has to support. Write them down while they're still plans.If one of those happens, is it a license or a rebuild? Ask this about every platform you're considering. A feature you can turn on is a line item. A core system you have to replace is a project.If you can't answer two of these in writing, you're not ready to compare vendors yet. Max walks through both sides in the episode.The Playbook(00:00) - Intro (00:41) - The mistake: treating insurance's four checkboxes as the finish line (04:22) - The play, step 1: what security buyers skip past SWG, CASB, and ZTNA (09:07) - The play, step 2: what actually gets security budget approved, and why ROI is the wrong pitch (13:19) - The play, step 3: test your backups before you need them (14:38) - What to watch for next: measuring security by detection and containment speed, not tools bought Resources MentionedMicrosoft 365 and Google Workspace, Max's first example of a decision that already limits which platforms fitSalesforce and HubSpot, the CRM choice that shapes what you can layer on top of itUnified communications (UCaaS), the phone system category in Max's example of checking a new platform against the hardware you already ownAbout Signed Signed is the podcast for buyers in a market built for sellers. Playbooks are the solo format: one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcomFull Transcript Click here to view the episode transcript.

Buying Microsoft 365, Google Workspace, or Azure direct feels like the simpler choice, until you need support or get locked out of your own tenant.In this Playbook, Max Clark breaks down what a Cloud Solution Provider (a CSP) actually does between you and the platform: faster support and escalation, help recovering a locked tenant, engineering and migration support, and access to vendor funding you can't reach on your own, usually at little or no added cost.If you're deciding whether to buy direct or through a CSP, or renewing that decision without ever having checked it, this one's for you.The Playbook(00:00) - The cold open (00:51) - What a CSP actually is (01:29) - Why Microsoft and Google aren't built to handle support directly (01:55) - Where a CSP actually sits between you and the platform (02:24) - The market development and incentive funds vendors push through CSPs (03:19) - The dedicated admin account problem most companies skip (04:17) - The real causes of a tenant lockout (05:14) - How being a sub of the CSP changes your escalation path (06:11) - The engineering, migration, and configuration work a CSP's own staff can do (06:38) - Why CSPs range from pure billing pass throughs to full service providers (07:03) - Tier zero versus tier one support (08:26) - The difference between support built for end users and support built for admins (09:25) - Why CSPs get paid through the platform's margin (10:17) - Max's bottom line: why the CSP relationship is worth having almost every time About SignedSigned is the podcast for buyers in a market built for sellers. Playbooks are the solo format, 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcomFull Transcript Click here to view the episode transcript.