Insights · Field note · Method and principles
Why we do not sell software
Reselling security products is a reliable revenue line for most firms in our field. We decline it so that our advice about products is worth having.
We do not sell, resell or take referral fees on software or security products. The reason is independence: a firm that earns margin on a product cannot credibly assess whether the client needs it, whether it is configured well or whether a competing product would serve better. When we review a client’s scanner, endpoint platform or SIEM, the client can be sure the finding is about the tool and not about our margin. Where no tool exists and one is needed, we specify it and the client buys it from whoever they choose. It is a smaller business than the alternative and a more useful one.
In detail
What the evidence shows.
The conflict
A reseller assessing the product it resells has every reason to find it adequate and every reason to recommend the upgrade. The conflict operates even on honest people, because it shapes which conclusion is easy. Clients often do not know their adviser is also their vendor until the invoice explains it.
What we do instead
Review the tools the client has: configuration, coverage, output, whether anyone acts on it. Specify what is missing in terms of capability, not brand. Support procurement with evaluation criteria. Validate the tool after deployment. The client owns the licenses and the relationship with the vendor.
Where it shows
Vulnerability program reviews that say the scanner is fine and the process is not. Endpoint oversight that finds coverage gaps rather than recommending a new agent. SIEM reviews that reduce sources rather than add them. Each is a recommendation a reseller would find hard to make.
The same rule in growth
We do not resell marketing platforms or take a percentage of advertising spend, for the same reason. See independence as a discipline, flat fees and aligned incentives and vulnerability management program review.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days