Ivanti Renewal, Part 1: Connect Secure Costs, the Intune Overlap, and the Device Audit

Transcript

Full narration of the briefing. Click a section heading to jump the player to that moment.

The breach window 0:00

Beginning in January twenty twenty four, Ivanti disclosed zero day vulnerabilities in Connect Secure and Policy Secure that nation state actors exploited to compromise government agencies, financial institutions, and critical infrastructure. CISA issued an emergency directive requiring agencies to disconnect the VPN products and run forensics before reconnecting. If your organization ran Connect Secure through that window, you absorbed real costs, and they belong in the renewal as a named commercial concession. I am Tom, Claire is with me, and this is part one of the VendorBenchmark Ivanti prep: the four shifts, and what you assemble before the first call.

The four shifts 0:48

Four shifts. The Connect Secure vulnerabilities disclosed in early twenty twenty four, authentication bypass and command injection allowing full network access without credentials, are a legitimate commercial lever, on the same logic as the SolarWinds remediation concession. Ivanti is privately held under Clearlake Capital and TA Associates, with the renewal dynamics that implies. The Neurons platform bundles an acquisition series, LANDESK, HEAT, Cherwell, RES, and every renewal proposes more modules at platform rates for capabilities you licensed as point products.

And Microsoft Intune, included in Microsoft 365 E3 and above, covers substantial Endpoint Manager ground at zero incremental cost.

The concession logic 1:37

The concession logic is precise. Patches are Ivanti's forward obligation to its customers. The concession addresses the investigation and response costs your organization absorbed during the breach window: incident response scope, the forensic vendor, credential rotation, session invalidation, network re segmentation, and any regulatory notification or audit triggered. Document all of it before call one.

Organizations that received the CISA emergency directive or confirmed compromise have the strongest position; organizations that incurred investigation costs without confirmed compromise have a secondary one based on the directed forensic requirement. Either supports the request, and the request is a rate reduction, a services credit, or extended support, in the order form.

The Intune overlap 2:33

Then the endpoint math. Intune at Microsoft 365 E3 covers unified endpoint management, device configuration, application deployment, patch management, and compliance policy across Windows, macOS, iOS, and Android. Map each active Endpoint Manager capability against that entitlement. What Intune does not cover at your tier, specifically third party patch management depth for non Microsoft applications and Ivanti's software distribution features, is the commercial justification, and only that differentiated scope is priced at Ivanti rates.

Build the per device comparison before call one: Endpoint Manager per device per year against zero incremental cost for Intune. The gap is your argument.

The three audits 3:21

Three audits complete the file. The device count audit: active Ivanti managed devices with management activity in the past ninety days against contracted, pulled from the Neurons console; decommissioned devices and devices migrated to Intune management do not need Ivanti licenses. The module usage audit: every Neurons module, Endpoint Manager, ITSM, Security Controls, Connect Secure, Policy Secure, with active device or user counts, active workflows, and whether it is the primary tool or a secondary one. And the competitive file: Freshservice priced for your ITSM agent count, Intune at entitlement for endpoint, and Zscaler or Palo Alto Prisma Access for the VPN replacement scope.

Freshservice and the calendar 4:12

The ITSM alternative matters more than most Ivanti customers realize. Freshservice provides incident management, service catalog, CMDB, and change management, including change advisory board workflows and risk scoring, at per agent rates significantly below Ivanti ITSM, and Ivanti account teams treat it as a real displacement risk in the mid market. ServiceNow competes at the enterprise level. And the calendar: Ivanti is private and its fiscal calendar is not disclosed, but Clearlake companies typically target December, so confirm the quarter in call one and aim at that window.

Part two walks the three calls. More briefings at redresscompliance dot com slash research videos.