How we halved the costs of our own ‘cyber penetration test’ using Market Dojo

Every year, our development team commissions a third party to test the security of the Market Dojo platform. This specialised piece of work is known as a ‘Penetration Test’ and represents a significant cost to Market Dojo. To run the event, we used our own platform to negotiate more efficiently with our suppliers. The results took us by surprise. 

Here is how our very own CTO, Nic Martin, saved 50% using Market Dojo…

Day 1 – creating the RFQ

To begin, I documented all our requirements. This document explained the service we wanted delivered; the payment terms; timelines; and everything else needed to ensure all the quotes we received would be comparable. Fortunately, we have run this type of event before, so I could refer back to the questions that the suppliers asked last year. 

Next, I created an RFQ event in the Market Dojo sandpit and added a short questionnaire to collect information from our participants. We would be awarding the business to just one company, so I added a single lot to collect prices for the entire service. Using the sandpit meant that I could do a test run of the event to make sure it worked the way I expected, before asking a colleague to review the event.

I am fortunate to work with some of the world’s leading eProcurement experts, so I got a “Rolls Royce” review! However, anyone with a background in procurement would be able to help at this stage. The review led me to add some more clarification to my document, and a couple more questions to my questionnaire.

While my colleague was reviewing the tender, I decided to find some participants. I already had a list from last time, but I decided to include more providers from the industry website – https://www.crest-approved.org/ .

Once we had our list of suppliers and were happy with the tender, I added the first 10 participants to the list and clicked ‘Invite participants and finish’. By adding 10 to begin with we were able to identify any gaps in the requirements that we had missed. I also decided to send an email to them all from my own email address, to make sure they knew to look out for the invitation.

Over the next few minutes,  I was able to see as the emails were delivered and when people had opened them. Seeing people receive my invitation was a really exciting part of the process. 

Day 2

11am

Mid-morning, I received a call from one of the participants who wanted to introduce themselves. We had a good call and I was able to make a note of the conversation in Market Dojo. I also asked the participant to send a relevant link using the messaging feature, so that I could refer back to it later, without having to wade through all my emails.

6pm

I saw that I had been emailed a quote. I wasn’t surprised, as I knew that the participants would be generating a lot of quotes for similar work, and would probably prefer to use their workflow than mine. I replied asking if they would be prepared to upload the quote to Market Dojo and explained how this would help us both. I spent some time trying to compose a good email, before saving it as a note against the participant I had invited. Doing this, ensured I had a saved record and could also access the email again if I needed to send it to anyone else.

Day 6

2pm

I had received a few notifications from the system, which I logged in to address.

First, I messaged a participant. Their proposal had been at a price higher than the ‘qualification price’ I had set. They had spoken to their finance team and wanted to know how they could update their proposal. I told them to upload the new version, and I would delete the old one.

I could also see that I had two full submissions (questionnaire and price), one of which was better than the price we received last year.

Now I was confident that the event included everything people needed to respond, I was able to send out the tender to my extended list of potential providers. Again, I followed this up with an email from my personal account, telling people to watch out for the invite. In the first five minutes, I received a few bounce backs, but more importantly, eight responses from people to say they would take part.

Day 7

I got a number of emails through the day with follow up questions. It was easy to reply using the message board, marking the messages as done as I completed them.

A few suppliers responded to say they were unable to offer the service I wanted, so I thanked them for letting me know and simply declined them from the event.

I did find that due to the number of people I invited, there were several questions to answer. However, using Market Dojo made the process feel easy to manage, and it helped that the questions were not mixed in with my regular emails.

Day 8-20

I received emails and phone calls from participants sporadically. Generally, it was very easy to track messages and reply to them.

It was frustrating when people sent initial submissions by email, but everyone was able to add them to Market Dojo when requested.

Day 21

The day before the RFQ deadline, the software sends an automated message to people that have not finished their submissions. This brought in a flurry of last-minute bids and a couple of extra questions. I was also surprised that it prompted the first contact from a couple of the people that had been invited.

Day 22 – deadline day

Again, I got a number of new submissions and questions. There were a few people that decided at the last minute not to bid, which at this point wasn’t a problem. This might have been concerning if it had happened at the start of the process, but by this stage, I had already received several good proposals. 

Once the deadline passed I checked the scores and answers for the leading submissions. I made the decision to award the business to a participant who had provided a good proposal, met our criteria and was 50% cheaper than the supplier we had used last year. I sent them a message to confirm their details before announcing the decision to them.

Day 23 – selection

I got confirmation back from the selected participant and also received a couple of enquiries from other participants asking when I would announce our decision. 

Day 24 – award

I signed and returned the contract to our selected supplier. I also saved a copy in our contract management module, along with some reminders for me, when it was time to re-run the exercise next year.

Finally, I sent a message to inform the other participants they had not been successful. I included feedback on why they had not been selected.

Conclusions

Using Market Dojo made it very easy to negotiate with our suppliers and ultimately, achieved a great result for my company. 

Having a clearly defined scope, certainly made conversations with our suppliers very simple. I was able to clarify exactly what we would be assessing people on, thanks to having a fairly rigid list of questions in my questionnaire. This gave me confidence that all the offers were comparable and made it very easy to select the winning bidder.

Next time, I will commit to a timeline for the decision process and include it in the requirements document. I think this would have streamlined the process even further, preventing a number of the messages and phone calls that I received.