The Signal
Three member companies are running the same swap right now. A higher-education CTO, a software IT operations director, and an architecture firm CIO are all replacing KnowBe4.
That is not an isolated cluster. Over the last 30 days, 20 companies in the DoGood network named an incumbent they intend to replace. They span 16 industries. Not one named a breach as the reason.
A construction CIO is dropping Red Canary because response times are not acceptable. A law firm security manager is taking eSentire to market as the renewal comes due. A nonprofit health system and a university are both replacing ServiceNow. A hospital IT director is cutting IBM footprint over licensing. A government deputy CISO may replace Tenable, and is reviewing whether Splunk stays.
The trigger has moved. Displacement used to follow an incident. Now it follows a renewal.
That changes who makes the call. A breach forces the security team's hand. A renewal gets decided by whoever counts the admin hours and reads the invoice.
From the Network
"We currently use Red Canary as our MDR provider. Their response times are not acceptable and we are going to replace them."
"We currently use eSentire for managed detection and response and our renewal is coming due... we want to see what is out on the market in the event we want to switch providers to something more responsive and modern."
"Our current training and human risk platform is outdated, and I do not believe it fits the needs of the business."
Three triggers, three industries: response time, renewal date, and fit. None of them is a security failure.
Top Open Priorities This Week
Two raw asks pulled directly from member submissions in the last 14 days, unedited:
"We migrated to ServiceNow three years ago and it has just been a lot for my small team to manage. I had to hire a developer and we still seem to spend more time creating and managing tickets vs. solving client problems."
"With everything related to IBM and the expenses, I'm trying to figure out ways to reduce the footprint and reliance. I'm really thinking about what the strategy is for licensing going forward for the next 3 to 5 years."
Both are pricing the cost of running the platform, not the cost of buying it. One counts it in headcount. The other counts it in licensing.
Member Spotlight: Howard Wolfe, FirstBank
Twenty members are shopping replacements this month. Howard Wolfe ran the opposite play. He leads information security at FirstBank. Facing a budget with no room for new tools, he audited what he already owned and renegotiated scope instead. He put it plainly in his DoGood member spotlight: "When there's no budget, your existing vendors become the strategy."
The Context
The headlines are catching up to what the network already knew. Microsoft's commercial price increase took effect July 1. Office 365 E3 moves from $23 to $26 per user per month. Microsoft 365 E5 moves from $57 to $60.
The date is not what matters. Existing customers do not pay the new price on July 1. They pay it at their next renewal. Enterprise Agreement customers also lost the Level D volume discount last November. Licensing analysts put the combined annual impact for that group at 15 to 23 percent.
So the renewal calendar is now where the repricing lands. That is the same calendar members are already using to decide which incumbents stay.
Bottom Line: The renewal stopped being a paperwork date. It is the one hour a year you hold leverage, and most calendars still treat it as an auto-approve.
What to Do About It
Pull every IT and security contract renewing in the next 12 months into a single list. Next to each one, write the reason you would keep it that is not inertia: response time, admin hours, or total cost after the increase. Anything you cannot answer in one line goes to market before the renewal, not after.
The CXO Brief is powered by the DoGood network, 5,000+ IT leaders sharing what they are actually working on.
Know a CIO who needs this? Forward it and they can subscribe here.
Enterprise IT leader at a $100M+ company? Apply to join DoGood.