Cybersecurity pilot scorecard

Blank worksheet, vendor-risk / SSO / SIEM parallel-path checklist, filled fictional example, and AI prompt for scoring a cybersecurity pilot toward PO or MSA.

Blank worksheet

Update weekly. Bring this to midpoint and to the commercial ask. Bound scope to one control / one environment / one business unit unless the agreement says otherwise.

Criterion	Baseline	Target	Current	Status	Owner
1. ___	___	___	___	[ ] G [ ] A [ ] R	___
2. ___	___	___	___	[ ] G [ ] A [ ] R	___
3. ___	___	___	___	[ ] G [ ] A [ ] R	___
4. ___ (optional)	___	___	___	[ ] G [ ] A [ ] R	___
5. ___ (optional)	___	___	___	[ ] G [ ] A [ ] R	___

Security parallel-path checklist

Start these in week one of serious interest, often before or alongside product proof instead of after "liked the dashboard." Track them as first-class workstreams beside product proof.

Workstream	Status	Blocker	Owner	Due
Vendor risk questionnaire	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
SOC2 / ISO packet	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
Pen-test / security questionnaire	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
SSO / SCIM	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
SIEM / SOAR / EDR integration	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
DPA / BAA (if data in scope)	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
MSA / PO path	[ ] Not started [ ] In flight [ ] Cleared	___	___	___

Working steps

Paste written success criteria into the scorecard before kickoff: MTTD/MTTR, false-positive rate, coverage % on named assets, alert volume / analyst hours, dwell time, critical vuln SLA, policy-violation rate. No soft "liked the dashboard" or NPS-only lines.

If there is a separate unpaid PoC / lab clock, name it. Put it on a separate sheet and keep it out of the paid pilot scorecard.

Update status every week. Treat amber without a next action as red.

Bring security ops and finance / economic buyer (or clear proxies) to midpoint. Re-score against written criteria only.

Before the commercial ask, confirm vendor risk, SSO/SCIM, and SIEM/integration are cleared or waived in writing, and that phase-two environment / BU / ACV intent is still in the agreement.

Filled example (fictional: AWS prod-a / identity + cloud-config)

Teaching example only. Pattern-check your deal; do not cite these numbers as a real case study.

Criterion	Baseline	Target	Current (wk 7)	Status	Owner
MTTD (critical misconfig class)	47m	≤15m	11m	Green	Chen / you
False-positive rate (pilot queue)	19%	≤12%	9.4%	Green	SOC
Coverage on named assets (`prod-a`)	71%	≥90%	93%	Green	You + detection
Alert volume / analyst hours	n/a	↓ ≥25% vs baseline	↓ 28%	Green	SOC lead
Vendor risk + SSO + SIEM	Not started	Live before ask	Live wk 6	Green	GRC / IT

AI prompt

Paste into ChatGPT or Claude. Replace bracketed placeholders with your deal facts.

You are helping a cybersecurity founder run a paid pilot that must convert to a PO or MSA with an enterprise or mid-market security buyer.

Company / product: [YOUR COMPANY + PRODUCT]
Buyer account: [COMPANY + SEGMENT]
Scope in pilot: [ONE CONTROL FAMILY / ONE TOOL CLASS / ONE BUSINESS UNIT OR CLOUD ACCOUNT OR SOC QUEUE]
Pilot window: [START] to [END]
Target phase-two ACV: [AMOUNT]
Security champion / CISO influencer: [NAME / TITLE]
Economic buyer: [NAME / TITLE, e.g. CIO / CFO / Head of Infra / procurement]
SOC / detection eng: [NAME / STATUS]
IT / identity (SSO/SCIM): [STATUS]
GRC / vendor risk: [STATUS]
SIEM / SOAR / EDR integration: [STATUS]
DPA / BAA (if needed): [STATUS]
Unpaid PoC / lab / red-team (if any): [N/A / SEPARATE CLOCK / STATUS]
Compelling event: [POST-INCIDENT / AUDIT OR SOC2-ISO-FEDRAMP / CYBER-INSURANCE / BOARD RISK / M&A DILIGENCE / CLOUD MIGRATION / SIEM-EDR REPLACEMENT / VENDOR CONSOLIDATION / ZERO-TRUST-IDENTITY DEADLINE / OTHER]

Produce:
1) A markdown scorecard table with columns:
Criterion | Baseline | Target | Current | Status (green/amber/red) | Evidence | Owner
Include 3-5 underwritable criteria (MTTD/MTTR, false-positive rate, coverage % on named assets, alert volume/analyst hours, dwell time, critical vuln SLA, policy-violation rate). No soft "liked the dashboard" or NPS-only lines.
2) A second table: Stakeholder | Role | Attitude | Next action this week
(Roles: security champion, EB, SOC/detection, IT/identity, GRC/vendor risk, privacy/legal, procurement)
3) A third table for the parallel path: Workstream | Status | Blocker | Owner | Due
(Include vendor risk questionnaire, SOC2/ISO packet, pen-test/security questionnaire, SSO/SCIM, SIEM/SOAR/EDR integration, DPA/BAA if needed, MSA/PO path)
4) End with 5 bullets: biggest risk, whether to ask for PO/MSA this week, scope-cut options (one control / one environment / one BU; hold list price), one quick-win memo angle for EB + security sponsor, one thing to stop doing.

Rules:
- Invent no fake metrics; use ___ when unknown.
- Every status needs a next action.
- Prefer reduce integrations / environments / business units / control scope over discounting list price.
- Security champion / CISO influencer is not the economic buyer.
- Unpaid PoC / red-team lab is not a paid customer pilot. Keep the clocks separate.
- Vendor risk, SSO, and SIEM often start before or alongside the pilot instead of after the dashboard demo.