When evaluating Intrusion Detection, what aspect do you think is the most important to look for?

- Capabilities, if we don't understand what these are it is unlikely we will have a success story.
- The expertise to operate
- Product documentation
- Training provided by a supplier
- Best practices
- Successful use case scenario (ideally from the same industry),
- Pricing (matters for local gov), etc.

Education, documentation, use cases and best practices.

Documentation. Algorithmic transparency. Ability to get someone smart on the phone FAST at the vendor, without going through gatekeepers. Confidence levels (statistical validity).