baselineRFIWhat is the platform's specific approach to detecting low-and-slow, long-dwell-time attack patterns characteristic of APTs, as distinct from detecting fast, noisy commodity malware — behavioral baselining over extended time windows, cross-session correlation, or threat-intelligence-driven hunting for known APT group TTPs?weight 3
Answer key — what a strong answer shows
APT detection requires fundamentally different techniques than commodity-malware detection (which relies on fast signature/behavior matches); ask the vendor to be specific about how their approach differs for genuinely patient, evasive adversaries versus noisy attacks.
baselineRFPDescribe the platform's threat intelligence on specific named APT groups (nation-state and sophisticated criminal actors) — is this intelligence proprietary/researched in-house, licensed from a third party, or a thin layer over open-source intelligence — and how frequently are new group TTPs incorporated into detection logic, with a customer reference for a real detection tied to a named APT group.weight 3
Answer key — what a strong answer shows
Deep, current APT-group-specific intelligence (not generic IOC feeds) differentiates a real APT-detection capability from marketing; ask for a concrete, real detection example tied to a named group and a customer reference, not just a claim of coverage.
baselineRFIHow does the platform correlate weak, individually-unremarkable signals across a long time window into a single high-confidence APT campaign detection — since APT activity is specifically designed to stay below the threshold that would trigger any single alert?weight 3
Answer key — what a strong answer shows
The defining challenge of APT detection is that individual actions look benign in isolation; ask specifically how weak-signal correlation over extended time works, since this is what separates real APT-detection capability from a relabeled generic threat-detection product.
baselineRFPDetail the typical dwell-time-to-detection performance the platform has achieved in real deployments (time from initial compromise to detection), and how this compares to industry-average dwell times, with a customer-referenced real incident.weight 3
Answer key — what a strong answer shows
A concrete, customer-referenced dwell-time figure is meaningful evidence; industry-average APT dwell time has historically been measured in months, so ask specifically how much this platform actually improves on that baseline in practice, not in theory.
baselineRFIWhat is the platform's approach to detecting living-off-the-land techniques (using legitimate system tools like PowerShell or WMI for malicious purposes) commonly used by sophisticated actors specifically to evade traditional malware detection, and what is the false-positive rate given these are also legitimately used by IT administrators?weight 3
Answer key — what a strong answer shows
Living-off-the-land detection is essential for APT coverage but inherently prone to false positives since the same tools are used legitimately; ask for the vendor's specific approach to distinguishing malicious from legitimate use, and a realistic false-positive rate.
baselineRFIWhat is the pricing model — per data source, per endpoint, or a flat enterprise tier — and how does cost scale as the organization's data volume and monitored-environment breadth both grow?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics; a vendor unable to project cost at meaningfully higher scale creates real budget risk for a growing APT-detection program.
baselineRFPDoes the vendor provide incident-response support with genuine nation-state/sophisticated-actor expertise for a confirmed APT detection, distinct from a generic IT incident-response team, and what is their real track record responding to a confirmed APT-attributed incident?weight 3
Answer key — what a strong answer shows
A confirmed APT compromise requires specialized response expertise (understanding sophisticated actor tradecraft, avoiding tipping off the attacker prematurely) that a generic IR team may lack — ask for evidence of real, specialized engagement history.
baselineRFIWhat compliance/regulatory reporting support exists if a detected APT campaign is attributed to a nation-state actor and triggers specific disclosure obligations (e.g., critical-infrastructure reporting requirements), and does the vendor help navigate that reporting process?weight 3
Answer key — what a strong answer shows
Nation-state-attributed incidents can trigger specific regulatory disclosure obligations distinct from routine breach notification — a vendor with experience navigating this is more valuable than one only equipped for generic breach response.
baselineRFPDetail historical trend reporting on APT-campaign detection and named-threat-actor activity trends over time, suitable for demonstrating threat-landscape awareness to leadership.weight 3
Answer key — what a strong answer shows
Trend-over-time reporting is a distinct capability from individual detection events — confirm this exists as a maintained, exportable report.
baselineRFIWho within the organization gets access to APT detection findings, and is there a strict, documented access model given that these findings can reveal sensitive nation-state targeting information with real operational-security implications if leaked?weight 3
Answer key — what a strong answer shows
APT detection findings are uniquely sensitive — premature disclosure could tip off a sophisticated attacker who's still active in the environment, or reveal genuinely secret nation-state targeting — ask for a specific, strict access-control model beyond generic RBAC.
baselineRFIHow does the platform integrate with the customer's existing SIEM/XDR and threat-intelligence platforms so APT-relevant weak signals are correlated across the full security stack rather than analyzed in a standalone tool with limited context?weight 3
Answer key — what a strong answer shows
APT detection inherently benefits from correlating signals across the broadest possible telemetry — a standalone tool with limited data-source access is materially weaker than one deeply integrated with the customer's full security stack.
baselineRFIHow consistent is APT-detection depth across multi-cloud/hybrid environments — is long-dwell-time behavioral correlation equally mature across on-prem, AWS, Azure, and GCP telemetry, or meaningfully shallower for one environment?weight 3
Answer key — what a strong answer shows
Ask for an honest per-environment coverage breakdown; uneven APT-detection depth across environments is a common real gap a vendor should disclose rather than obscure.
baselineRFPGiven the sophistication of what's being hunted, what is the realistic false-positive burden a SOC team should expect, and what analyst skill level/staffing does the vendor recommend to actually operate this platform effectively rather than it becoming an unused, alert-generating black box?weight 3
Answer key — what a strong answer shows
APT-detection tooling often requires meaningfully more skilled analyst time to operate effectively than commodity threat detection — a vendor should be honest about the real staffing/skill investment required, not just the detection capability itself.
baselineRFPDo you have advanced threat detection capabilities and if so, please describe them.weight 3
baselineRFPContractor shall evaluate and implement emerging tools designated by the organization that utilize AIOps and behavioral analytics to automate incident containment and prevent attacks before they manifest, and support adoption of machine learning-based security analytics to identify patterns indicative of advanced persistent threats (APTs).weight 3
baselineRFPMeet minimum/preferred qualifications: minimum 5 years conducting penetration testing and red team operations; team certifications (OSCP, GPEN, CEH, GWAPT, or advanced OSEE/OSCE/GXPN); demonstrable APT simulation/adversary emulation experience; custom tool development capability (not solely Cobalt Strike/Metasploit); published security research or CVE discoveries.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
