Should BlueVoyant prioritize expanding its Third-Party Cyber Risk Management service to cover more vendors or focus on deepening analysis for existing covered vendors?

Introduction

The trade-off we're examining today is whether BlueVoyant should prioritize expanding its Third-Party Cyber Risk Management service to cover more vendors or focus on deepening analysis for existing covered vendors. This decision is crucial for BlueVoyant's growth strategy and market positioning in the cybersecurity space. I'll analyze this trade-off by considering various factors including business impact, user needs, technical feasibility, and resource allocation.

Step 1

Clarifying Questions (3 minutes)

• Based on the current market demand, I'm thinking there might be pressure to expand vendor coverage. Could you share insights on customer requests for broader vendor coverage versus deeper analysis?

Why it matters: Helps align our strategy with market needs Expected answer: Mixed feedback, with larger enterprises favoring depth Impact on approach: Would influence whether we prioritize breadth or depth

• Considering our revenue model, I assume we charge per vendor analyzed. Is this correct, and are there any pricing tiers based on analysis depth?

Why it matters: Directly impacts the financial implications of our decision Expected answer: Tiered pricing model based on vendor count and analysis depth Impact on approach: Would help quantify the revenue impact of each option

• Looking at user behavior, I'm curious about how often clients act on the insights we provide. Do we have data on remediation rates for high-risk findings?

Why it matters: Indicates the value clients derive from our current depth of analysis Expected answer: Varied remediation rates, with deeper analysis leading to higher action rates Impact on approach: Would influence the decision to focus on depth if it drives more client value

• From a technical perspective, I'm wondering about our current platform's scalability. How easily can we onboard new vendors versus enhancing our analytical capabilities?

Why it matters: Determines the feasibility and resource requirements for each option Expected answer: Onboarding is streamlined, but enhancing analytics requires significant development Impact on approach: Would affect the timeline and resource allocation for each option

• Regarding our team capacity, how are our analyst resources currently allocated between vendor onboarding and in-depth analysis?

Why it matters: Helps understand the operational impact of shifting focus Expected answer: Analysts split 60/40 between onboarding and deep analysis Impact on approach: Would inform how we might need to restructure teams or hire for either option