Society of Payment Security Professionals - Payment Security Blog

Vendor experience from RSA

I’ve spoken with several vendors at RSA and some are better than others at positioning their product within a specific market.  This year, everyone is talking about two things at RSA: risk and regulatory compliance.  Of those, what I really care about is PCI and specifically the payment services space.  I’ve learned some of the good and bad ways that vendors market their materials.

The following are a list of several common pitfalls of vendor marketing:

1. Promising the world - Every product seems to address PCI compliance… and GLBA, HIPAA, SOX, and if asked I’m sure the vendors would say they address XYZ LMNOP compliance.  The problem with this is that of over committing and under delivering.  Vendors can tell their VC firms their product will save the world, but never tell potential customers - unless you plan on delivering in a big way.
2. PCI DSS Mapping - The next step up from spelling PCI is to perform a 1-to-1 mapping of every single PCI DSS requirement to your product.  Again, this is an error of promising too much and never really delivering on any.  Companies that read the detailed PCI DSS requirements want to address as many of them as possible so they find ways that their products can meet their custom interpretation of each requirement.  Many marketing people consider this to be understanding their client’s needs, when in all reality there is no one product that meets every single PCI DSS requirement.
3. Being agnostic to the data - In an effort to be everything to everyone, many vendors say their product is agnostic of the data.  We can protect it all!  The problem again is that you become a generalist and do not show anyone that you understand the specific needs of their data.  Sometimes it’s good when your product can protect all data, regardless of type, but how do you communicate to each customer that you understand their needs?

When entering the Payment Services space it is paramount that vendors understand the specific business needs of the market.  Vendors need to understand the top problems companies have in addressing compliance and how their product eases those problems.  Without a solid understanding of the data and the market’s business needs a company may struggle communicating with their prospective customers.

Also, companies want their vendors to educate them.  I’ve written about this before, but it’s paramount that vendors understand their clients market better than their clients do.  A potential customer wants to visit a vendor website and be educated about the current business needs and other roadblocks they have not yet encountered.  If a vendor can accomplish this they can reach the coveted position of being a market leader - and more importantly, someone their customers can trust and respect.

For more information on entering the Payment Services market space, please check out our service offering.