Related Posts
What are the best Sales books y’all read?
Bowl Leader
Daily Wordle!
JUL. 19th 2022
🟢🟡⚪🟢🟢
🟢🟢🟢🟢🟢
Pro
Chief
Pro
Additional Posts in In-House Counsel
Conversation Starter
Thoughts on Media.Monks legal department?
Conversation Starter
Rising Star
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
A reseller isn’t going to negotiate with you because their hands are tied because they need to honor the flowdowns from the OEM. Unless you have a massive spend, there’s no reason for them or a large OEM to negotiate with you on a commodity solution like this.
Are you dealing directly with the software provider or a broker? If the former, Unless you are the size of Microsoft you’re going to have a hard time. A/V and EDR aren’t perfect and so they’re bot going to want to budge on e.g. anything close to opening up liability.
Broker maybe you can wiggle a bit.
Yeah CDW is just a reseller and they’re not going to want to take on any liability whatsoever.
Think of it like this - vulnerabilities in these products are detected hourly, never mind daily. But they’re still absolutely essential.
You might want to check with your MSP if they resell, and then try to get with that purchase a carveout for gross neg/willful behavior, and tie that all back to their insurance policy (check for exclusions, try to get named on policy).
Pro
Are these boutique, artisanally crafted antivirus offerings? Sounds like the companies are too small to have in house commercial counsel.
Or, not even point the finger but shrug your shoulders and say you took comm reas efforts to prevent viruses.
Chief
I’ve seen quite a bit of this from a SAAS perspective, especially for things like CM tools. There’s so much potential liability and these are supposed to be plug-and-play commercial offerings such that even the biggest players won’t negotiate.
Chief
Yep, we’ve seen several “take it or leave it” offerings recently. Honestly, after a recent dispute we had, I get it.
Chief
Many companies that provide an off-the-shelf type of product or service, especially where they offer the ability to self-purchase through a subscription, have no interest in reading your red lines unless you are spending mid to high five figures or even 100k+.
What could you possibly need to redline that badly in a standard software license agreement?
A lot of SaaS companies won’t make redlines unless you reach whatever arbitrary purchase amount. Usually, it’s around $100k (in my experience). It’s hard to ask for changes if your purchase is like $20k over a three year period. I work for a large government agency, and the only reason we are able to redline for certain things is because we will have to cancel the purchase order otherwise. I am sure it’s different for purchases in private sector when you don’t have government policies or laws to use as a justification.
I would write up a risk summary and have your internal biz clients approve it. Push them to do their research and make sure they’ve selected a reputable vendor. It sounds like you have already done a lot to identify the risks and push for a reasonable resolution, and now your clients need to make a tough situation about whether to take the deal as-is or walk away.
This is the direction we are headed. Many of the responses above are a little tone deaf, and don’t reflect the reality of negotiating agreements in the software space, and make assumptions that are false. We’ll inform the biz that this seems to be common practice in this one industry (we’ve not had an issue negotiating these points in any other industry), and let the business make the call with eyes wide open as to the legal risk.
Rising Star
Talk to your CISO or head of IT before talking to the business/procurement side. They’ll likely confirm a lot of what the vendor is saying.
B2C is not B2B, so not a useful comparison. It’s strange, not something I’ve encountered before and it sounds to me like that might be the norm in that industry (however flimsy the reasons may be)
Two I'd recommend are Cylance and Sophos. Both are AI based products and neither one is outrageous in terms of cost.
I wouldn’t sweat it personally. Review the terms, flag issues for your biz team and let them make the call on whether the downside risk is outweighed by better pricing/functionality.