Evaluating Security Solutions and Technologies

Mid-level managers are increasingly involved in decisions about the tools, platforms and technologies their teams use. Even when the final decision rests with IT, security, or procurement functions, managers are often asked to contribute requirements, assess suitability for their team’s context, or evaluate proposals from suppliers. Understanding how to approach those evaluations from a security perspective is a practical management competence.

It is important to be clear about the appropriate scope of this competence. Managers are not expected to evaluate the technical architecture of a security product, assess its code quality or conduct a penetration test. They are expected to ask the right questions, recognise when a proposed solution genuinely addresses the security risk it claims to address, understand the governance and compliance implications of a technology choice, and advocate for security considerations to be taken seriously in commercial and operational decisions.

Questions Every Manager Should Ask

When a new technology, tool or platform is being considered for use by your team, the following questions provide a structured framework for security evaluation from a management perspective:

About the data

• What data will this solution access, process or store? Understanding the data implications of any technology is the starting point for security assessment. If a tool will handle personal data, commercially sensitive information or data subject to regulatory requirements, those implications must be understood before adoption.
• Where is data stored and who has access to it? In a cloud-hosted solution, understanding where data is physically stored (and therefore which jurisdiction’s data protection laws apply) and what the provider’s own access to customer data is requires explicit verification, not assumption.
• How is data protected in transit and at rest? Encryption is a fundamental protection for data. Understanding whether a proposed solution encrypts data appropriately is a basic due diligence question.

About the supplier

• What security certifications or assurance does the supplier hold? ISO 27001 certification, SOC 2 reports and equivalent assurance frameworks provide evidence that a supplier has implemented a structured security management approach. Their absence does not automatically mean a supplier is insecure, but it is a relevant consideration.
• What is the supplier’s track record on security incidents? A supplier that has experienced significant security incidents is not automatically disqualified, but understanding how those incidents were handled, communicated and learned from is important context for assessing the quality of their security management.
• What are the contractual security obligations? Understanding which security obligations the supplier is accepting under the contract, including breach notification timelines, data deletion at the end of the contract, and audit rights, is important for both legal protection and ongoing governance.

About integration and governance

• How does this solution integrate with existing security controls? A new tool that introduces its own authentication system, creates new data flows or requires exceptions to existing security policies creates governance complexity that should be understood before adoption.
• Who will have administrative access, and how will it be managed? Administrative accounts carry elevated risk. Understanding who will hold administrative access to a new system, how that access will be controlled and reviewed, and what happens to that access when the administrator leaves the organisation is part of basic security governance.
• How will compliance with this solution be monitored over time? A tool that is carefully evaluated at adoption and then never reviewed again may create growing security risks as the organisation changes, the threat landscape evolves, and the tool’s own security posture shifts. Understanding how ongoing governance will work is as important as the initial evaluation.

Avoiding Common Evaluation Pitfalls

• Security theatre: some security solutions are more effective at demonstrating security activity than at reducing actual security risk. A manager who can distinguish between a solution that genuinely addresses an identified risk and one that primarily creates a sense of security without changing the underlying vulnerability is adding real value to the evaluation process.
• Feature creep and vendor inflation: security vendors often present their solutions as comprehensive answers to broad security challenges. A proportionate evaluation focuses on whether the specific risk the solution is intended to address is genuinely reduced, not on the comprehensiveness of the feature set.
• Neglecting the people dimension: a technically excellent solution that is difficult to use or requires behaviours that conflict with how work actually gets done will be circumvented. Any security technology evaluation should include an assessment of how it will be received and used by the people it is intended to protect.
• Ignoring ongoing cost and effort: security solutions have ongoing costs beyond the initial purchase: configuration maintenance, user training, incident response integration, vendor relationship management and periodic reassessment. These costs should be understood as part of the full cost-benefit evaluation.