Often in a sales meeting, I get asked common questions like “can you handle our procurement,” “have you worked with [some specific piece of software],” or “what is your response time.” These questions are usually centered around our technical ability, not our trustworthiness. These are reasonable things to ask, but they’re not the right questions.
Your IT provider will be one of the most intimate relationships you form with a vendor, with access to your financial systems, your IP, your client records, your backups, your email. There’s no license, accreditation or certification required to open an IT or cybersecurity company, either — literally anyone can hang a sign that says “Managed Security Provider,” whether they’ve ever actually run a network or not. With that much at stake and no external filter standing between you and them, the questions you ask become the only vetting that exists.
I am going to tell you WHY questions around technical ability matter less than you think.
Most people aren’t qualified to vet whether or not the answers are valid. If you’re not technical yourself, you have no real way of knowing whether what you just heard about privilege escalation, attack surface reduction and zero-day vulnerabilities was actually insightful or just noise. So your brain reaches for the only measuring stick it has: they clearly know a lot of technical words, and they said them confidently, so they must be good at this.
Those common questions don’t actually tell you much. Anyone reasonably competent with Google or ChatGPT can track down a technical fix these days — that’s not really the hard part anymore. What you’re not finding out is whether the people you’re talking to will still be around a year from now, will actually show up when it’s a real emergency instead of just when their contract says they have to, or will be accountable when something’s gone wrong and it’s their fault. And something WILL go wrong. That’s not pessimism, it’s just reality when computers, humans, and the internet are all involved in running a business at the same time.
Besides, technical skill (while obviously very important), isn’t actually the most important thing to look for. A vendor who’s brilliant technically can still be the wrong choice, because security and IT work don’t happen in a vacuum — they happen inside a business full of actual humans trying to get their jobs done, and a fix that’s technically perfect can still be a bad fix if it ignores that.
A tech I once worked with was technically talented but holistically challenged. A user submitted a ticket about their Outlook crashing. The source of the issue was traced to a malfunctioning email add-on that the user relied on daily. The tech’s fix was to uninstall the add-on, and he then emailed the user to say the issue was fixed and closed the ticket, without any further explanation given. Sure, Outlook stopped crashing, but now the user had a new issue — the add-on they relied on for their workflow was no longer there. When confronted, the tech’s response was “But I fixed it — Outlook doesn’t crash anymore.” That’s the pattern to watch for: solving the narrow problem directly in front of you while missing the impact on the person you were supposedly helping.
This type of tunnel vision ends up costing time and money. At a larger scale, it can cost a business years of work and thousands of dollars.
So it is vital for long-term success that you ask the right questions when you are choosing your vendor.
So what do you actually ask?
The selection process should be treated less like a purchase decision and more like a job interview, especially given that most vendors lock you into long-term contracts with significant cancellation fees. You wouldn’t make a long-term hire with that kind of access to your data without a high level of vetting and certainty, and this decision deserves the same scrutiny.
Ask what happens when they screw up. Every IT company has a story here, whether they’ll admit it or not — we certainly do. Someone who can walk you through a mistake plainly, without three layers of PR softening wrapped around it, is telling you more than any features list ever could. Someone who can’t name one is either brand new or not being straight with you, and neither is a great sign.
Ask how they handle it when several clients all hit a company-wide emergency on the same day. Many vendors will tell you they’re always available, but few of them have actually thought through what happens when three clients are down at once and there’s one team to go around. The answer tells you whether they’ve been honest with themselves about their own limits and processes.
Ask how they actually measure whether their own technicians are doing good work. If the honest answer is something like “how fast tickets get closed,” pay attention to that — it’s the exact incentive that produced the Outlook story earlier. A company that measures its people purely on speed is quietly training them to do the narrow fix and move on. The vendors worth trusting are measuring something closer to whether the problem actually stayed fixed.
A few more worth asking, quickly: what happens — and what it costs — if you want to leave early; who you’ll actually be talking to day to day, especially if a senior person led the sales conversation, and how the handoff and escalation actually work; what they’re bad at; how long they’ve been in business; and what their staff turnover looks like.
What it actually comes down to
Not “can they do the job.” Most competent shops can fix the thing directly in front of them — that tech fixed Outlook, after all. It’s whether they can see past that: whether they’ll tell you the truth when something’s broken, own it when it’s their fault, and think about your business as a whole instead of whichever ticket is open right now.
That’s a harder thing to figure out over a sales call than a list of supported software. But it’s the only part that actually matters once you’ve signed.
