Mastering CrowdStrike Negotiations Post-Disruption

Few names resonate as strongly in the world of cybersecurity as CrowdStrike. Known for its cutting-edge technology and robust security solutions, CrowdStrike has become a go-to provider for many enterprises. However, recent incident service disruptions have cast a shadow over CrowdStrike’s reputation. For companies that use CrowdStrike for security services and are about to engage in a renewal cycle, strategic negotiation methodologies can be used to leverage these incident service issues and improve terms.

Setting the Stage: The CrowdStrike Conundrum

In July 2024, CrowdStrike experienced a significant incident service disruption, affecting numerous clients across various industries. The incident, caused by a faulty software update, led to widespread system crashes and operational disruptions. This incident was not just a technical glitch for many businesses but a wake-up call to reassess their reliance on a single provider and the associated costs.

As the incident was resolved, procurement teams were tasked with renegotiating contracts with CrowdStrike. The goal was clear: secure better pricing and terms considering the recent incident. But how does one negotiate with a provider as formidable as CrowdStrike? The answer lies in a blend of preparation, strategy, and leveraging the right data.

The Power of Preparation

Negotiation is an art, and like any art form, it requires meticulous preparation. According to a study conducted by Harvard’s Program on Negotiations, the likelihood of success in negotiations significantly increases when one is well-prepared. This principle holds especially true when dealing with complex providers like CrowdStrike.  Effective negotiation starts before the first conversation: it begins with your internal analysis, market research, supplier-specific intelligence, and financial impact modeling.

1. 1. Internal assessment: It is crucial to assess your current state and future needs. This involves understanding your organization’s security requirements, evaluating CrowdStrike’s performance, and identifying any gaps or areas for improvement. This assessment should also anticipate the costs of transitioning to a different provider and the change management effort for processes and procedures.
   2. Breach incident related data collection and analysis: The next step in preparation is gathering relevant data. This includes understanding the extent of the incident, its impact on your operations, and the financial losses incurred. Detailed records of downtime, lost revenue, and additional operational expenses provide a solid foundation for your negotiation stance.
   3. Market research: Conducting a market scan to understand the pricing and service levels of other cybersecurity providers can offer valuable insights. This comparative analysis helps in benchmarking CrowdStrike’s offerings against industry standards and identifying areas where they may be falling short. Here, Avasant’s benchmarking services can play a pivotal role. By incorporating benchmarking services from Avasant into your market research, you can ensure that your negotiation strategy is well-informed and data-driven. This approach not only strengthens your position but also increases the likelihood of securing favorable terms with CrowdStrike.
   4. Supplier research: Knowing what has changed with your key suppliers before renewal negotiations is critical. Avasant’s Supplier Intelligence Service continuously monitors vendor market activity, strategic pivots, and product or SKU modifications – enabling you anticipate pricing and negotiation behaviors. In the case of CrowdStrike, for example, the recent shift to bundled Falcon Complete SKUs has pressured many customers to expand their CrowdStrike product adoption or face steep premiums on standalone SKUs. Insights like these help buyers approach negotiations with foresight rather than reaction.

Crafting the Strategy

With a robust preparation phase complete, the next step is to craft a negotiation strategy. This strategy should be multifaceted, addressing both the immediate need for cost reduction and the long-term goal of securing reliable security services.

1. 1. Leverage the incident: The recent security incident provides a strong leverage point. Highlighting the incident’s impact on your operations and the associated costs can strengthen your case for reduced pricing or unbundled SKUs. Emphasize the need for compensation for the disruptions caused and the importance of restoring trust in their services.
   2. Scenario analysis: Developing multiple negotiation scenarios with a corresponding strategy can help anticipate CrowdStrike’s responses and prepare counterarguments. These scenarios include best-case, worst-case, and most likely scenarios.
   3. BATNA (Best Alternative to a Negotiated Agreement): Identifying your BATNA is critical. This involves understanding your alternatives if negotiations with CrowdStrike fail. Whether it’s switching to another provider, reducing the bill-of-materials to only must-have components, or enhancing in-house capabilities, having a clear BATNA provides a fallback option and strengthens your negotiation position.

The Negotiation Process

Armed with data and a well-crafted strategy, the negotiation process begins. This phase requires a blend of assertiveness, empathy, and flexibility.

1. 1. Initial discussions: Start the negotiations by acknowledging the value CrowdStrike has provided in the past. This sets a positive tone and shows that you are approaching the negotiation in good faith. However, quickly transition to discussing the recent incident and its impact on your organization.
   2. Presenting the case: Use the data collected during the preparation phase to present a compelling case for your target outcomes. Highlight the financial losses incurred due to the incident and the need for compensation. Be clear and concise in your presentation, focusing on the facts and avoiding emotional arguments.
   3. Exploring options: Engage in a collaborative discussion to explore various alternatives. These could include reduced pricing, extended service credits, no-fee license periods, price protection for future years, or enhanced service levels. Be open to creative solutions that address both parties’ interests.
   4. Closing the deal: Once a mutually agreeable solution is identified, work towards closing the deal. Ensure that all agreed-upon terms are clearly documented and included in the contract. This includes any commitments from CrowdStrike to enhance their security measures and prevent future incidents.

Real-World Application: A Case Study

To illustrate these strategies in action, let’s consider a real-world case study involving a multinational corporation (MNC) that successfully renegotiated its contract with CrowdStrike following a significant security incident.

Negotiating with a complex provider like CrowdStrike requires a blend of preparation, strategy, and effective communication. By leveraging this security incident and presenting a well-supported case, organizations can secure better pricing and terms. The key lies in thorough preparation, understanding your alternatives, and engaging in collaborative discussions. As illustrated by the case study, these strategies can lead to successful outcomes, ensuring that your organization continues to receive reliable cybersecurity services at a fair price.

In the ever-evolving landscape of cybersecurity, staying informed and prepared is crucial. By adopting these negotiation methodologies, organizations can navigate the complexities of dealing with providers like CrowdStrike and achieve favorable outcomes.

By Tracell Frederick, Manager and David Acklin, Senior Director