Quick Answer: Shiny new object syndrome (SNOS) happens when MSPs adopt new technology without properly vetting it against their people, processes and existing tech stack. This raises risk exposure and can weaken an organization's overall risk posture. GTIA members can use the Third-Party Vendor Management Guidebook in the Member Portal to build a formal vendor risk evaluation process.
Listen, I get it. Some of us need to be on the bleeding edge of technology. A vendor released a new product, and BAM! You are the first one in line two weeks before Best Buy opens. Don’t lie, you know it’s true. I have seen you in line! And I have been there too.
SNOS (shiny new object syndrome) is real. Most MSPs don’t realize the impact this very real, even if made up, syndrome has on their business. We simply review and immediately implement those shiny new objects without properly vetting why they are being added to the tech stack. If you’ve read my blog posts before, you know what’s coming next.
The Real Cost of Skipping Due Diligence
What is the risk you just introduced? Have you evaluated the real impact to your people, process and existing technology to ensure the business can handle this new object without taking a negative hit to your risk posture or your risk appetite?
If you don’t know the complete answer to the first question, the answer to the second one should help you realize, very quickly, the impact. If you still don’t know, then you should probably back out the new object until you can fully and completely answer both questions.
Taking time to evaluate, even if you already implemented it, doesn’t mean it is not a good fit or valuable to your organization. The business should have a process for “due diligence” before implementing anything new.
You do this with your people; why not the same process and vetting for your tech stack? All too often, I see organizations walking around at a conference or trade show listening to the marketing or sales team tell them why their product is the best. Very rarely do I hear anyone ask the hard questions during the sample demo.
The Hard Questions
Do you provide detailed documentation for us to properly evaluate your product?
- Implementation instructions
- Sample test plan
- API documentation (if needed)
- A detailed list of permissions by account for both implementation and operations of the product
Does this product come with an evaluation license?
- 30, 60, 90 days
- Does it come with support access?
- Are you open to feedback on the product during the evaluation?
- If we move forward, is there any difficulty we should be aware of moving from our testing environment into operations?
Why Does This Matter?
Shiny objects are a distraction and often lead to increased risk in a business with no thought given to the direct impact it will have on the organization. This isn’t something only for the business owner. Service managers and technicians alike do not properly assess “why” they are proposing a new tool or process, along with the evaluation of the risks the organization will need to evaluate and subsequently mitigate if the solution is approved.
Good news, GTIA has resources available to help you and your organization create a vendor risk program. The Third-Party Vendor Management Guidebook is available within our Member Portal for GTIA members.
This resource, along with many others available on a variety of topics, was created by a member, Nett Lynch, CISO at Kraft Kennedy, for members as a way of sharing her experience setting up a vendor management program within many organizations. It is worth noting that Nett has provided a great framework for any size organization to start or enhance its vendor risk management program. Once you, the MSP, have tackled setting up your organization’s program, you can share this with your clients to help them address their vendors.
By doing it for yourself first, you learn answers to some of the questions your clients may ask. Together, you can work closely to mitigate risks within each of your environments you didn’t even realize existed. Shiny new object syndrome will become a thing of the past, and your future client relationships will become more rewarding.
Frequently Asked Questions
What is Shiny New Object Syndrome (SNOS)? SNOS describes the tendency to adopt new technology products immediately after release, without evaluating their impact on existing people, processes and systems.
Why is SNOS a risk for MSPs? Implementing new tools without due diligence can increase an organization's risk exposure and shift its risk posture without anyone realizing it happened.
What questions should MSPs ask before adopting new technology? Ask vendors for implementation instructions, a sample test plan, API documentation and a detailed list of account permissions. Also ask whether an evaluation license is available, what support access looks like during that period and whether moving from testing to full operations presents any difficulties.
How can MSPs build a vendor risk management program? GTIA members can download the Third-Party Vendor Management Guidebook in the Member Portal, a framework created by member Nett Lynch, CISO at Kraft Kennedy, for building or strengthening a vendor risk program at any size organization.
Can MSPs use this framework with their own clients? Yes. Once an MSP has implemented a vendor risk program internally, the same framework can be applied to help clients evaluate and manage risk in their own vendor relationships.
GTIA members, download the Third-Party Vendor Management Guidebook on the Member Portal.
Not a member yet? Join now!
