A friend bought a used Toyota last year. Nine years old, just about a hundred thousand miles, and a dent in the passenger door the salesman called “character.” It still came with a ninety-day powertrain warranty. If the transmission fell out on the interstate, the dealer would pay to put it back in.
Now picture the IT director at a regional bank signing a three-year contract for security software that finds vulnerabilities in her network. Every year, the bank pays about what my friend paid for that Toyota. When she asks the vendor what happens if an attacker gets in anyway, the sales rep suddenly gets very interested in the next slide.
A used-car dealer, a profession nobody has ever accused of excessive honesty, will stand behind a nine-year-old Toyota and that’s part of why you buy it. The security vendor won’t stand behind software it shipped last quarter and charges six figures for.
A warranty is a promise with money attached. The vendor says its product works and agrees to pay you if it doesn’t. If breaking a promise costs the vendor nothing, every vendor can make it, the good ones and the bad ones alike. You can’t tell them apart by reading the brochure. You can tell them apart by asking who will write a check.
And, as it turns out, some will.
More security companies now put money behind their claims. One backup vendor will pay up to ten million dollars if it can’t restore your data after a ransomware attack. Several detection and response providers offer breach warranties of a million dollars or more. Our company, Root Evidence, pays out five million through the Evidence Platform Warranty if we miss an asset that gets breached, or fail to warn a customer they have a vulnerability that leads to compromise. These vendors have agreed to lose money when they’re wrong, which in this industry passes for a bold new idea.
The vendors who refuse remind me of a roofer who finishes the job, takes your check, and leaves a note on the kitchen counter: “Not responsible for leaks.” Keeping water out is the whole job. You’d never hire him again, and you’d warn the neighbors. Security buyers have been finding that note on the counter for twenty years, and they keep hiring the same roofers.
Ask one of the holdouts why, and you get a speech.
“Attackers are sophisticated.”
“Every environment is unique.”
“Security is a journey…”
I’ve dealt with plenty of car dealers, and not one of them told me driving is a journey and the transmission might simply decide to leave.
The speech covers up some simple arithmetic. A vendor that trusts its own product expects to pay out rarely, so a warranty costs it very little. A vendor that doesn’t trust its product expects to pay out often, so it skips the warranty and gives the speech instead. When a vendor won’t guarantee its product, it’s telling you how well it thinks the product works.
Economists call this a costly signal. A warranty only makes sense for a vendor that expects to rarely pay it, which is why it tells a buyer more than any demo. A demo shows the product on its best day. A warranty shows how the vendor expects it to perform on every other day.
Warranties still deserve a careful read. Some pay only after your cyber insurance runs out. Others cap the payout so low that the headline number is just decoration. Read the exclusions the way you’d read the fine print on a car warranty, hunting for the part that explains what voids it.
Before you count a warranty as real, ask four questions. Does it pay before or after my cyber insurance? Is the payout capped per incident or per year? What do I have to do to stay eligible? Who decides whether a claim qualifies?
Then ask every security vendor the question my friend asked about a nine-year-old Toyota: if this breaks, what happens?
A vendor that answers with a number believes in what it sold you. A vendor that answers with a speech about the threat landscape has answered too.