Aegis / Ironworks Corp - Vendor Comparison Discussion

I think we should just get into it, Maria. I'll be honest with you — and I don't want this to feel like an ambush — but we've been having some pretty serious conversations internally about whether Aegis is still the right fit for us.

-2Catherine discloses serious internal conversations about whether Aegis is still the right fit. · competitive alternative

It's — well, it's a few things. Russell, do you want to start with the Detect stuff since that's kind of where it kicked off?

Sure. So, look — the outage in March. That was a really bad week for us. We're a manufacturing environment, we've got operational technology, we've got floor systems that we're trying to keep visibility on, and for roughly six hours we had nothing. Zero threat monitoring. And I found out about it because one of my guys noticed alerts had stopped coming in, not because Aegis told us.

-1Russell describes the six-hour blackout and that they discovered it themselves. · service reliability

Yeah, and that's — Russell, I hear you and I want to acknowledge that because that outage was, um, it was a significant failure on our part. The event processing pipeline had a cascading failure and it exposed a single point of failure in our ingestion layer that frankly should not have existed. I'm not going to sugarcoat it.

I mean, at least you're saying that. But the communication piece is what really stung. We're paying for a platform that's supposed to be our eyes and ears and we essentially found out through the back door that it was blind.

-1Russell says the communication lapse 'stung' and they found out 'through the back door'. · support experience

That's a fair criticism and it's one I've already escalated internally. The post-incident review identified that our customer notification process was too slow and too passive. We've since put in redundant processing nodes and implemented a circuit breaker pattern so that kind of cascade can't happen again, but I also want to be clear — the communication gap was a separate failure and it's one we're actively fixing.

Okay but here's my thing, Maria — and I want you to really hear this — we're in manufacturing. We've got ISO 27001 we're working toward, we've got customers asking us about SOC 2 now, and we cannot have a situation where our security monitoring just goes dark and we don't know about it for hours. That's not a 'we're fixing the process' situation, that's a trust issue.

-1Catherine says the outage is 'a trust issue' given compliance requirements. · service reliability

I completely understand, and I don't want to minimize that. Can I ask — since the remediation went in, have you seen any further gaps or performance issues with Detect specifically?

No, it's been stable since then. But stable for three weeks after a six-hour blackout isn't exactly confidence inspiring, you know?

-1Russell notes three weeks of stability is 'not exactly confidence inspiring'. · service reliability

That's fair. And I'm not asking you to just take my word for it. I can get you a formal RCA document and the engineering team can actually walk you through the architecture changes if that would help rebuild some confidence.

That might actually be useful, yeah. But — and I don't want to just pile on here — there's also the compliance piece. Russell and I were looking at the reporting functionality last quarter and it just felt really... limited? Like we couldn't get the kind of on-demand reporting we needed.

-1Catherine describes reporting functionality as 'really limited'. · product capability

So this is actually something I do want to flag because it's timely — Aegis Comply v2 just went GA last week, on April 7th. And one of the headline features is exactly that — on-demand compliance reporting across SOC 2, PCI DSS, HIPAA, and ISO 27001. Like, you mentioned ISO 27001 a minute ago, that's now a supported framework.

And I take responsibility for that communication gap on my end. You should have been looped in on the Comply v2 roadmap well before GA. Can I ask — what does the evaluation look like right now? Are you in active conversations with other vendors?

Yeah, we've been talking to Fortiguard Pro. They reached out to us actually, about six weeks ago, and their pitch was pretty compelling especially on the compliance and reporting side.

We've had two demos and they're putting together a proposal. Russell, what's your read on them technically?

Honestly their UI is cleaner. Alert triage feels a bit more intuitive. But I've got questions about how they handle OT environments specifically because a lot of their case studies seem very IT-centric and we've got Siemens PLCs on the floor that I need visibility on.

That's a really important point and it's actually one of the areas where I think Aegis Detect has genuine depth — the OT and ICS coverage specifically. But I don't want to just tell you that, I'd rather show you. Have you actually stress-tested Fortiguard Pro against your OT environment or is that still pending?

Still pending. Their proposal is supposed to address it but we haven't seen it yet.

Okay. So here's what I'd like to propose — and tell me if this feels like too much — but I'd like to set up a technical session with our OT security specialist and your team specifically around the manufacturing use case, Siemens environment included. And separately, I want to get you into a Comply v2 demo because I genuinely think what you see is going to be different from what you've experienced before.

I mean, I'm open to it. Catherine?

I'm open to it too but I want to be honest — we're not going to be swayed just by demos at this point. The March outage shook our confidence and we need more than a good product presentation to feel like Aegis is the right long-term partner. Does that make sense?

-1Catherine says they are 'not going to be swayed just by demos' and need more than a presentation. · competitive alternative

It makes complete sense. And I respect you for saying it that way. What would it take — like, genuinely, what would rebuilding that trust look like for you? I want to understand what success looks like from your side.

Honestly? A few things. We want the RCA documentation Russell mentioned. We'd want some kind of SLA commitment or credit structure for monitoring downtime specifically — not just generic uptime guarantees. And we want to actually see the Comply v2 reporting in action for ISO 27001 because that audit in May is real and we need to be able to produce documentation.

All of that is reasonable and I can work toward all three. The RCA I can get you this week. The SLA conversation I'll need to pull in our account executive and potentially our VP of Customer Success, but I don't think what you're asking for is out of reach. And the Comply v2 demo — I can have that scheduled within the week. Would next Tuesday or Wednesday work?

Wednesday works better for me. Russell?

Wednesday's fine.

We appreciate that. Like I said, we're not looking to leave just for the sake of leaving — switching vendors mid-audit cycle would be a nightmare. But we need to feel like Aegis has its house in order.

Understood. I'll follow up with a summary email this afternoon — RCA timeline, the Wednesday Comply v2 demo, and next steps on the SLA discussion. Anything else before we wrap?