Vendor library

Buying signals

• data-centre exit or cloud migration
• new AI or data platform
• resilience, sovereignty or multi-account governance gap

Routing boundaries

• Do not map a generic cloud mention without a named workload, owner and change event.
• AWS supplies platform capabilities; specialist third-party controls may remain required where evidence identifies a distinct control gap.

Architecture and dependencies

• Region and service availability vary.
• Customer architecture, identity, network connectivity, data classification and shared-responsibility controls must be established.
• Contracting entity and marketplace/channel entitlement are geography-specific.

Discovery questions

1. Which workloads and outcomes are in scope, and why now?
2. Which regions, residency rules, accounts and landing-zone controls apply?
3. Which managed-service constraints, availability targets and recovery objectives must be met?
4. Who owns cloud economics, security architecture and commercial commitment?

Buying signals

• firewall or branch refresh
• security-tool consolidation
• campus, OT, application or SOC modernisation

Routing boundaries

• Do not route a pure DDI, autonomous EDR, data-centric SSE or specialist high-scale ADC requirement to Fortinet by default.
• Acquired-product lineage is not proof of current integration, SKU availability or entitlement.

Architecture and dependencies

• Physical, virtual, cloud and SaaS deployment models differ by family.
• Feature availability varies by appliance, FortiOS release, subscription and geography.
• Fabric integration depth must be validated for the exact products and versions.

Discovery questions

1. Which program is primary: edge, branch, campus, OT, SASE, SecOps, application or cloud security?
2. What Fortinet and competitor estate exists and when does it renew?
3. Which shared policies, telemetry and operational outcomes justify consolidation?
4. Which models, subscriptions, throughput and inspection requirements apply?

Buying signals

• security tools cannot see east-west or encrypted traffic
• tool cost and packet duplication are rising
• hybrid-cloud migration is breaking visibility

Routing boundaries

• Gigamon supplies visibility and traffic processing; it is not the primary enforcement control.
• Investment, partner and portfolio material cannot prove exact SKU support.

Architecture and dependencies

• Physical taps, virtual taps, cloud mirroring or agent-based acquisition must be designed per environment.
• Tool destinations, throughput, packet fidelity and encrypted-traffic authority must be established.
• Licensing differs across GigaVUE-FM, GigaVUE-OS, modules, GigaSMART and cloud volume.

Discovery questions

1. Where is traffic currently unavailable or too expensive to observe?
2. Which tools require packets, flows, metadata or decrypted sessions?
3. What throughput, topology and cloud-account scope applies?
4. Which acquisition method and privacy controls are acceptable?

Buying signals

• AI or data-centre fabric build
• campus refresh with operational simplification
• network automation, telemetry or change-control gap

Routing boundaries

• Do not equate network observability or segmentation with endpoint, SSE or full security enforcement.
• Acquired and separately branded products require exact lifecycle, integration and SKU validation.

Architecture and dependencies

• Hardware platform support and EOS features vary.
• CloudVision is offered as SaaS and on-premises; lifecycle policies differ.
• VeloCloud, Wi-Fi, DMF and AGNI packaging require explicit entitlement checks.

Discovery questions

1. Is the funded domain AI/data centre, campus, WAN, cloud networking or operations?
2. Which topology, speeds, optics, routing scale and availability targets apply?
3. What automation, telemetry and compliance workflow is required?
4. Which EOS, CloudVision and adjacent-product licences are needed?

Buying signals

• email compromise or Microsoft 365 protection gap
• backup and ransomware recovery concern
• lean team needs managed XDR, branch or application protection

Routing boundaries

• An acquisition announcement or future embedding statement cannot become a GA capability.
• Confirm whether requirements belong to email, backup, XDR, network or application control rather than treating Barracuda as one undifferentiated suite.

Architecture and dependencies

• SaaS, appliance, virtual and public-cloud delivery varies by product.
• CloudGen subscriptions and services have separate licence validity.
• Identity capabilities require an exact current-product and entitlement check.

Discovery questions

1. Which risk domain and operating team owns the funded problem?
2. What Microsoft 365, server, cloud, branch and web-app estate is in scope?
3. Is the desired operating model product-led, co-managed or fully managed?
4. Which licence package, retention, throughput and recovery objectives apply?

Buying signals

• hybrid data fragmentation
• private enterprise AI program
• Hadoop modernisation, lakehouse or governance initiative

Routing boundaries

• The supplied discovery playbook is a design fixture, not product authority.
• Legacy CDH, HDP and CDP naming must not create duplicate active products; technical-preview and entitlement qualifiers must be preserved.

Architecture and dependencies

• Cloud, on-premises and hybrid services have different support matrices.
• Cloud providers, runtime versions, storage, identity and network prerequisites must align.
• Some data-sharing and hybrid capabilities are technical preview or entitlement-gated.

Discovery questions

1. Which data and AI workloads must run where, and why?
2. Which legacy platforms, runtimes and migration constraints exist?
3. What governance, lineage, sovereignty and workload-portability outcomes are required?
4. Which cloud, on-premises and entitlement dependencies apply?

Buying signals

• endpoint or ransomware program
• cloud or identity attack-path gap
• SIEM modernisation or managed detection requirement

Routing boundaries

• Do not route pure network infrastructure, DDI or SSE requirements to CrowdStrike.
• Acquired capabilities and integrations must retain GA, preview, packaging and data-ingestion qualifiers.

Architecture and dependencies

• Falcon sensor and cloud modules vary by endpoint/workload and package.
• Data ingestion, retention and module dependencies affect SIEM and XDR outcomes.
• Identity and cloud coverage require directory, account and workload integration.

Discovery questions

1. Which funded entry point is primary: endpoint, cloud, identity, SIEM, exposure or MDR?
2. What endpoint, workload, directory and security-data scale applies?
3. Which incumbent modules, retention, integrations and renewal dates matter?
4. Does the team want self-operated, co-managed or managed response?

Buying signals

• manual or fragmented DDI
• DNS-borne threat or exfiltration
• unknown assets, hybrid-cloud network automation or brand abuse

Routing boundaries

• Infoblox is not EDR, a full SSE platform, NGFW or SIEM.
• Announced transactions and retired BloxOne DDI SKUs must not become current native capability or sellability claims.

Architecture and dependencies

• NIOS appliances, virtual instances and NIOS-X service points differ.
• Existing DNS authority, IP plan, cloud accounts and automation platforms must be mapped.
• NIOS release, hardware generation and licence type affect support.

Discovery questions

1. Is the root problem DDI authority, DNS security, asset truth or external digital risk?
2. Which DNS, DHCP, IPAM and cloud-native systems exist?
3. How are addresses, assets and changes reconciled with CMDB and automation?
4. Which NIOS release, platform and subscription constraints apply?

Buying signals

• proxy or VPN replacement
• SaaS, DLP or unmanaged-device gap
• branch SASE or enterprise AI governance

Routing boundaries

• Netskope is not EDR, authoritative DDI or an application-delivery controller.
• Edition, region, steering path, product lifecycle and entitlement constrain broad SASE and AI claims.

Architecture and dependencies

• Traffic steering, client, tunnel, browser and API modes vary by use case.
• Identity provider, endpoint posture, application inventory and data classifications are prerequisites.
• Licences expose exact product codes, quantities and AI usage entitlements.

Discovery questions

1. Which entry point is funded: web/SaaS, ZTNA, data, branch, browser, cloud posture or AI?
2. Which users, devices, sites and applications generate the traffic?
3. What data activities must be allowed, coached, blocked or audited?
4. Which steering, identity, licence and regional requirements apply?

Buying signals

• workforce SSO, MFA or passwordless transformation
• joiner-mover-leaver, access-review or privileged-access control gap
• customer authentication or identity-threat program

Routing boundaries

• Okta is not EDR, SIEM, SSE, DDI or network enforcement; route by the identity population and control point.
• Auth0 is an owned but distinct customer-identity platform and must not be treated as an interchangeable alias for every Okta workforce product.

Architecture and dependencies

• Directory, HR source, application, device and identity-provider integrations must be mapped before policy or lifecycle design.
• SAML, OIDC, SCIM, agent and connector support varies by application and deployment pattern.
• Workforce Identity and Customer Identity use distinct tenants, packaging, identity populations, regional options and commercial entitlements.

Discovery questions

1. Is the funded identity population workforce, privileged users, non-human identities, partners or application customers?
2. Which directories, HR sources, applications, devices and authentication protocols are in scope?
3. Is the primary outcome access, lifecycle, governance, privileged control, threat response, posture or customer experience?
4. Which tenancy, region, integration, assurance, availability and entitlement constraints apply?

Buying signals

• content or records modernisation
• application-security or DevSecOps program
• IT operations, identity, data-protection or service-management consolidation

Routing boundaries

• OpenText corporate breadth never proves a specific product match.
• Historical brands, Micro Focus lineage and divested businesses require current product ownership and lifecycle proof.

Architecture and dependencies

• SaaS, private cloud and software delivery varies widely by product.
• Legacy product names and licence schedules must be resolved at product level.
• Integration with content repositories, identity, developer toolchains and operations data must be scoped.

Discovery questions

1. Which OpenText domain and exact product owns the outcome?
2. What legacy brand, version, repository or operational platform exists?
3. Which data, compliance, workflow and integration requirements apply?
4. What current licence schedule, deployment model and support lifecycle governs the product?

Buying signals

• firewall or SASE transformation
• CNAPP or cloud-SOC convergence
• XDR/SIEM modernisation or AI application protection

Routing boundaries

• Acquired products remain distinct until exact integration, GA and packaging evidence proves otherwise.
• Do not infer a funded displacement from an incumbent Palo Alto mention without pain, timing and ownership.

Architecture and dependencies

• Hardware, VM, cloud-native and SaaS models have separate licences and release trains.
• Panorama or Strata Cloud Manager, identity, endpoint and cloud integrations affect operations.
• Product and cloud-region availability must be checked at feature level.

Discovery questions

1. Which platform outcome is primary: network, SASE, cloud, SOC, AI or services?
2. What PAN-OS, Prisma, Cortex and competitor estate exists?
3. Which traffic, users, cloud accounts, data and response workflows are in scope?
4. Which licences, subscriptions, integrations and renewal dates create the decision window?

Buying signals

• phishing, BEC or account-takeover exposure
• insider risk, DLP or DSPM program
• regulated archive, supervision or enterprise AI governance

Routing boundaries

• Proofpoint is not an endpoint, NGFW, DDI or network-infrastructure platform.
• Acquisition context does not prove every announced AI-security function is integrated, GA or entitled.

Architecture and dependencies

• Mail-flow, Microsoft 365 or Google Workspace integration is foundational for email controls.
• Endpoint agents, cloud connectors, identity and data classification vary by module.
• Archive, compliance and AI capabilities have distinct regulatory and packaging constraints.

Discovery questions

1. Is the funded problem email, identity/human risk, data, compliance or AI?
2. Which mail, collaboration, identity, endpoint and data repositories are in scope?
3. What threat, regulatory or change event creates urgency?
4. Which modules, retention, regions and managed-service requirements apply?

Buying signals

• ransomware recovery concern
• legacy backup modernisation
• cloud/SaaS or identity recovery gap

Routing boundaries

• Do not equate backup completion with tested cyber recovery.
• Private-preview, roadmap and GA identity-resilience capabilities must remain separate.

Architecture and dependencies

• Workload support depends on Rubrik CDM/RSC release and compatibility matrix.
• Archive targets, immutability, network, identity and retention design affect recovery.
• Each major CDM release follows a support lifecycle and upgrade path.

Discovery questions

1. Which workloads, identities and SaaS systems have explicit recovery objectives?
2. What immutable copies, isolation, clean-room and test practices exist?
3. Which CDM/RSC versions and compatibility constraints apply?
4. What RPO, RTO, retention and cyber-insurance evidence is required?

Buying signals

• ransomware or EDR replacement
• cloud or identity lateral-movement risk
• SIEM cost, analyst workload or 24x7 coverage gap

Routing boundaries

• SentinelOne is not a network access, DDI, SSE or infrastructure platform.
• Preview and announced AI offerings require exact GA and package evidence.

Architecture and dependencies

• Agents, cloud connectors, identity integration and telemetry ingestion vary by family.
• Retention, endpoint count, MDR scope and package tier change outcomes.
• AI features must be checked for region, release and entitlement.

Discovery questions

1. Which entry point is funded: endpoint, cloud, identity, SIEM/data, AI or MDR?
2. What endpoint, workload, directory and data-ingestion scale applies?
3. What response, rollback, retention and operating-model outcome is required?
4. Which package, renewal and integration constraints apply?

Buying signals

• ransomware lateral-movement concern
• segmentation program stalled by complexity
• third-party, OT or service-account access exposure

Routing boundaries

• The ambiguous alias Zero is forbidden.
• Agentless simplicity claims do not remove the need to validate operating-system firewall, directory, network and application dependencies.

Architecture and dependencies

• Directory, network telemetry and host-firewall compatibility must be validated.
• ZTNA and segmentation enforce at different control points.
• Legal entity, geography, package and API support require exact contract evidence.

Discovery questions

1. Which lateral-movement path or access population is in scope?
2. Which hosts, devices, directories and operating systems can enforce policy?
3. What exceptions, learning period and application dependencies exist?
4. Is the funded outcome microsegmentation, identity segmentation, ZTNA or a phased combination?

Buying signals

• unknown or novel-threat detection gap
• network, email, cloud or OT behavioural visibility
• lean SOC needs autonomous response or managed monitoring

Routing boundaries

• Ownership context cannot substitute for product, architecture, lifecycle or entitlement evidence.
• Behavioural detection should not be presented as a replacement for every preventative control.

Architecture and dependencies

• Sensors, integrations, data sources and response authority differ by domain.
• Appliance, virtual and cloud-service specifications must be validated.
• MDR, response and data-processing terms are separately scoped.

Discovery questions

1. Which domain lacks visibility or response: network, email, cloud, OT, identity or exposure?
2. Which telemetry and enforcement integrations are available?
3. What autonomous action is permitted and how will it be governed?
4. Which product modules, services, deployment and data-residency terms apply?

Buying signals

• east-west visibility or investigation gap
• packet evidence needed for incidents
• network and application performance issues share the same telemetry need

Routing boundaries

• NDR, IDS, forensics and performance are distinct capabilities with separate retention and package needs.
• ExtraHop visibility and detection do not replace network policy enforcement.

Architecture and dependencies

• Sensors require traffic access through taps, mirrors or cloud-native sources.
• Console, sensor, recordstore and packetstore sizing affect retention and performance.
• Subscription and protocol-module licences affect available data and features.

Discovery questions

1. Which networks, clouds and traffic paths must be observed?
2. Is the priority detection, packets, records, performance or a combination?
3. What throughput, retention and encryption requirements apply?
4. Which response, SIEM, endpoint and cloud integrations are required?

Buying signals

• microsegmentation mandate
• ransomware blast-radius concern
• hybrid application dependency and lateral-movement visibility gap

Routing boundaries

• Renamed products and legacy CloudSecure documentation must resolve to one current identity.
• Visibility, policy authoring and enforcement must be distinguished for each workload type.

Architecture and dependencies

• PCE, VEN and lightweight/agentless approaches vary by use case and release.
• Label design, application owners, host compatibility and existing firewalls affect enforcement.
• Vulnerability features and deployment modes have separate licences.

Discovery questions

1. Which workloads, endpoints and clouds define the containment scope?
2. What application dependency and label data is trustworthy?
3. Which enforcement points and operating systems are supported?
4. What rollout, exception, policy-test and licence model is required?

Buying signals

• Oracle database or application modernisation
• OCI migration, sovereign/dedicated region or multicloud program
• ERP/HCM/SCM transformation

Routing boundaries

• Oracle corporate breadth never proves a specific product fit.
• OCI, database, applications and industry products require separate owners, architectures, licences and evidence.

Architecture and dependencies

• Commercial, government, dedicated-region, Cloud@Customer and SaaS models differ.
• Database editions, options, metrics and application modules have detailed licensing.
• Identity, network, data migration and coexistence architecture must be explicit.

Discovery questions

1. Which Oracle product, workload and business outcome is actually funded?
2. Is the program infrastructure, database, application, integration, security or industry specific?
3. What version, edition, option, region and deployment model applies?
4. Who owns licensing, migration, architecture and operating change?

Buying signals

• legacy IGA replacement
• PAM and governance convergence
• third-party, non-human or AI identity risk

Routing boundaries

• Savient is a forbidden misspelling and unsafe alias.
• Financing is not acquisition; IGA, PAM, ISPM, application and AI modules need separate package proof.

Architecture and dependencies

• Native SaaS and private-cloud options have different architecture constraints.
• Authoritative HR, directories, applications, roles and entitlement data must be integrated.
• Connector coverage, data quality and operating governance determine time to value.

Discovery questions

1. Which identity populations and applications are in scope?
2. Is the funded outcome lifecycle, certification, PAM, posture, external or non-human identity?
3. Which source systems, connectors, roles and toxic combinations must be governed?
4. What deployment, residency, package and implementation-service requirements apply?