4 ms·

Some really great advice in this post, I am going through the same thing trying to price my security application SaaS, have settled on £20/month at the moment.

by rakkhi 16y ago

Some really great advice in this post, I am going through the same thing trying to price my security application SaaS, have settled on £20/month at the moment. It is currently in development and I would love some feedback on the frontpage: http://db.tt/LHjMnwy http://db.tt/LHjMnwy I actually started with costs and considering it is all on Amazon infrastructure and I am outsourcing development offshore the costs are pretty low. I had not fully calcuated the cost of customer aquisition though so that is something I will need to do. Thus far I was working on £10k / year on advertising which consisted of Google adwords, social media and niche print advertising market mix. I was also going to promote it directly via presentations to my contacts but I had not priced that time as I can do that while still doing my consulting role (at least initially, and if it goes well I can hire some sales guys). I am concerned about what glenngillen says regarding the perception issue. Security products are expensive: e.g a few competitors such as Archer (http://bit.ly/9Z7Xyq http://bit.ly/9Z7Xyq), RSAM (http://bit.ly/cSjzDz http://bit.ly/cSjzDz) and riskwatch (http://bit.ly/bhlzYY http://bit.ly/bhlzYY) are well over $10K per year for most companies. If I price at £20/m is it too low and will it be percieved as "cheap" and non "enterprise" or will I be able to undercut the competition and appeal to the smaller merchants who still needs security software for PCI-DSS level 1 and 2 compliance?

maukdaddy 16y ago
I see Archer's logo in your screenshot. If you are truly replacing some of Archer's functionality, then $20 might be too low ;)
- rakkhi 16y ago
  It replaces some of Archers functionality in that 2 of the Archer modules are: risk management and threat management. However Archer is the rolls royce, it ties to be all Governace Risk and Compliance (GRC) to all people. It is also a lot broader than just security risks and can be used for all sorts of operational risks. And for that you pay the rolls royce price and companies where I have worked that have used it have need a team to support and develop/customize features and entire training courses to learn how to use it My software enables users a lot simpler way of performing the risk assessment functionality focused on information security. It is designed to be really easy to use, turn-key with zero setup but still robust in the methedology, reporting and collaboration. You can also export to Archer if you have it. That is what I'm wondering though... is $20 too low.. should I start at $100? I am talking to two MD's of large financials this week who maybe prospective clients and have agreed to mentor me so I will get their opinion on it also. How much value do you think security risk assessment software that assists to cut your security costs by prioritizing investment where it makes a difference and helps you comply with regluation like PCI-DSS is worth to a customer? It is B2B only: target markets are large firms with large mobile security teams (30-100 in IT security) and smaller merchants that need to do risk assessments to comply with PCI-DSS Level 1 and 2
  - maukdaddy 16y ago
    I work with a customized Archer risk management module at work, so I'm pretty familiar with it. If you are targeting the enterprise/B2B market, they're going to laugh at $20. In theory, PCI compliance is worth whatever revenue you bring in with credit cards, since being non-compliant theoretically means you could lose all of that revenue. That said, the typical model of security software is to charge as much as you possibly can. You're making a product that supposedly interfaces with Archer - who can easily charge $50k+ in renewal fees each year. Enterprise customers usually equate higher $$$ with better functionality/more security. I say that with significant experience consulting and working for large enterprises. I'd thinking about charging significantly more, maybe even in the $499 range depending on the exact functionality of your product. This is interesting, because I've recently been thinking a bout product ideas around the assessment process. Archer is WAY overkill for a lot of businesses, even some large businesses.
    - rakkhi 16y ago
      Thanks I really appricate your advice. Being familier with Archer and obviously the B2B Infosec / Risk market - if you were a buyer price would you pay for a SaaS security risk assessment software that is lot simpler to setup and use than Archer?
igrekel 16y ago
There may be other problems with being too cheap. Sometimes there is a minimal cost threshold for something to be a project in large companies. If it is not an "official" project, it will lag. Another aspect of pricing too low is that if the manager in a large company paid a lot of money for something, they'll put pressure on the organization to use it. If it was cheap, they won't put as much pressure. In large companies, most employees have a lot of inertia in their way of working so that extra pressure might be beneficial. Finally, its always easier to lower the price than to increase it.
- rakkhi 16y ago
  totally agree with that last point. With it not being an "official project" I would actually prefer this. My experiance with espeically with pure security projects (as opposed to security piggybacking on other projects to get what they want) trying to get a business case for a project is really tough. So getting project approval, prioritization, resources all rolling is a very hard and time consuming process. I want this app to be something anyone in a IT security department can just subscribe and use straight away. If it gets a shadow IT following and the orgainzation really likes it I can get then sell a gold or platinum customization piece which will be a proper project with procurement and contracts involved and consulting time from my company Your third point - I really don't want people to be preasured to use this because of the investment, the users then grow to hate the product and that is no good for anyone.
phugoid 16y ago
Feedback: The "Cancel anytime" as a feature seems out of place to me. Likewise for the Better than money back guarantee. It sets the wrong tone. I want this software to be so awesome it will be a privilege to be allowed to pay for it. The log in box doesn't fit there in location or in style. It looks like it's a sub-point of FAQ right now. It draws the eye away. The little screenshots all look like they come from different applications.
- rakkhi 16y ago
  Thanks good feedback: yeah I was worried a bit about the perception of cancel anytime and better than money back gurantee. My thinking was following advice from Tim Ferris (fourhourworkweek.com) and reducing the buyer risk /buyer remorse issue. Even in B2B I know first hand there is a lot of buracracy in getting anything like a software purchase (even SaaS approved). I wanted people that liked the idea to be able to easily put it on a credit card and try it out without the risk - maybe a free 30 day trial is a better way to go with this Ok will work on the login box. The screenprints are placeholders for now, will be replaced with actual screenprints when the pages are finalized.
jlees 16y ago
Quick gut reaction to your comments - yes, £20 is way too low, you can go up at least an order of magnitude if not all the way to £500. If you are targeting companies that are already paying staffs of 30-100 in IT security, even £500 is a drop in their budget. Find out what the maximum spend is before someone higher up the management chain has to approve it (often £5k or £20k) and chop a bit off ;)
- rakkhi 16y ago
  Good idea, getting those number are not so easy but I will work my contacts. The key point was I wanted to tap into the shadow IT economy (http://rww.to/bQETAj http://rww.to/bQETAj), because even though maybe somone in IT security can approve below £5K at a big bank this would still need a purchase order, contract, procurement process etc especially if it is £500p/monnth. I wanted it to be something that if someone liked or heard about they could put on their credit card and start using.

by rakkhi 16y ago

maukdaddy 16y ago

I see Archer's logo in your screenshot. If you are truly replacing some of Archer's functionality, then $20 might be too low ;)

rakkhi 16y ago
It replaces some of Archers functionality in that 2 of the Archer modules are: risk management and threat management. However Archer is the rolls royce, it ties to be all Governace Risk and Compliance (GRC) to all people. It is also a lot broader than just security risks and can be used for all sorts of operational risks. And for that you pay the rolls royce price and companies where I have worked that have used it have need a team to support and develop/customize features and entire training courses to learn how to use it My software enables users a lot simpler way of performing the risk assessment functionality focused on information security. It is designed to be really easy to use, turn-key with zero setup but still robust in the methedology, reporting and collaboration. You can also export to Archer if you have it. That is what I'm wondering though... is $20 too low.. should I start at $100? I am talking to two MD's of large financials this week who maybe prospective clients and have agreed to mentor me so I will get their opinion on it also. How much value do you think security risk assessment software that assists to cut your security costs by prioritizing investment where it makes a difference and helps you comply with regluation like PCI-DSS is worth to a customer? It is B2B only: target markets are large firms with large mobile security teams (30-100 in IT security) and smaller merchants that need to do risk assessments to comply with PCI-DSS Level 1 and 2
- maukdaddy 16y ago
  I work with a customized Archer risk management module at work, so I'm pretty familiar with it. If you are targeting the enterprise/B2B market, they're going to laugh at $20. In theory, PCI compliance is worth whatever revenue you bring in with credit cards, since being non-compliant theoretically means you could lose all of that revenue. That said, the typical model of security software is to charge as much as you possibly can. You're making a product that supposedly interfaces with Archer - who can easily charge $50k+ in renewal fees each year. Enterprise customers usually equate higher $$$ with better functionality/more security. I say that with significant experience consulting and working for large enterprises. I'd thinking about charging significantly more, maybe even in the $499 range depending on the exact functionality of your product. This is interesting, because I've recently been thinking a bout product ideas around the assessment process. Archer is WAY overkill for a lot of businesses, even some large businesses.
  - rakkhi 16y ago
    Thanks I really appricate your advice. Being familier with Archer and obviously the B2B Infosec / Risk market - if you were a buyer price would you pay for a SaaS security risk assessment software that is lot simpler to setup and use than Archer?

igrekel 16y ago

There may be other problems with being too cheap. Sometimes there is a minimal cost threshold for something to be a project in large companies. If it is not an "official" project, it will lag. Another aspect of pricing too low is that if the manager in a large company paid a lot of money for something, they'll put pressure on the organization to use it. If it was cheap, they won't put as much pressure. In large companies, most employees have a lot of inertia in their way of working so that extra pressure might be beneficial. Finally, its always easier to lower the price than to increase it.

rakkhi 16y ago
totally agree with that last point. With it not being an "official project" I would actually prefer this. My experiance with espeically with pure security projects (as opposed to security piggybacking on other projects to get what they want) trying to get a business case for a project is really tough. So getting project approval, prioritization, resources all rolling is a very hard and time consuming process. I want this app to be something anyone in a IT security department can just subscribe and use straight away. If it gets a shadow IT following and the orgainzation really likes it I can get then sell a gold or platinum customization piece which will be a proper project with procurement and contracts involved and consulting time from my company Your third point - I really don't want people to be preasured to use this because of the investment, the users then grow to hate the product and that is no good for anyone.

phugoid 16y ago

Feedback: The "Cancel anytime" as a feature seems out of place to me. Likewise for the Better than money back guarantee. It sets the wrong tone. I want this software to be so awesome it will be a privilege to be allowed to pay for it. The log in box doesn't fit there in location or in style. It looks like it's a sub-point of FAQ right now. It draws the eye away. The little screenshots all look like they come from different applications.

rakkhi 16y ago
Thanks good feedback: yeah I was worried a bit about the perception of cancel anytime and better than money back gurantee. My thinking was following advice from Tim Ferris (fourhourworkweek.com) and reducing the buyer risk /buyer remorse issue. Even in B2B I know first hand there is a lot of buracracy in getting anything like a software purchase (even SaaS approved). I wanted people that liked the idea to be able to easily put it on a credit card and try it out without the risk - maybe a free 30 day trial is a better way to go with this Ok will work on the login box. The screenprints are placeholders for now, will be replaced with actual screenprints when the pages are finalized.

jlees 16y ago

Quick gut reaction to your comments - yes, £20 is way too low, you can go up at least an order of magnitude if not all the way to £500. If you are targeting companies that are already paying staffs of 30-100 in IT security, even £500 is a drop in their budget. Find out what the maximum spend is before someone higher up the management chain has to approve it (often £5k or £20k) and chop a bit off ;)

rakkhi 16y ago
Good idea, getting those number are not so easy but I will work my contacts. The key point was I wanted to tap into the shadow IT economy (http://rww.to/bQETAj http://rww.to/bQETAj), because even though maybe somone in IT security can approve below £5K at a big bank this would still need a purchase order, contract, procurement process etc especially if it is £500p/monnth. I wanted it to be something that if someone liked or heard about they could put on their credit card and start using.