HailBytes ASM Proof of Concept Process

Qualify the buyer

Validate that the operational shape (cloud account, asset count, target-domain set, integration tooling) matches what HailBytes ASM is built for, before committing engineering and account-management time to a larger rollout.

Validate the fit

Confirm that findings quality, scan cadence, integration evidence, and compliance mapping match what the evaluator's internal stakeholders need, on the timescale they need it.

Demonstrate end-to-end value

Produce a closeout package the evaluator can take to their decision-makers without translation. Findings, asset changes, attack paths, compliance mapping, integration evidence, and a recorded walkthrough video are all in the standard deliverables set.

Generate procurement signal

Move the conversation from "does this work?" to "what's the right rollout band?" by the closeout. The four-stage decision-gate framework gives the evaluator a credible path from PoC to 1,200+ tenants without a renegotiation at each stage.

14-day Light PoC

Right for: fast validation, evaluators who want a yes/no on findings quality before committing to a longer evaluation.

• One cloud (AWS or Azure)
• Five seed domains
• HailBytes-run (Mode A) only
• Findings report, Asset Change Summary, attack-path chart, recorded walkthrough, closeout doc
• Compliance report optional, one framework, on request
• Integration evidence light (one integration, sandbox-friendly)

30-day Standard PoC

Right for: procurement-grade evaluation, partners building a sales narrative, customers who want integration evidence in the closeout package.

• One or two clouds (AWS, Azure, or both)
• Up to 50 seed domains
• Mode A (HailBytes-run) or Mode B (customer self-deploys)
• All seven deliverables in the standard set
• Integration evidence across multiple tools (SIEM, Jira, Slack, ServiceNow)
• Compliance report against one named framework, included in the standard package

Mode A — HailBytes-run

HailBytes deploys the ASM stack in the customer's cloud account (or in a HailBytes-managed sandbox account, customer's choice), monitors the scan, generates the findings report, and presents the closeout. The customer observes.

Right for: evaluators who want to see results without operating the platform during the PoC, partners who want HailBytes to do the technical lift while they own the customer relationship.

Customer time commitment: ~2 hours kickoff, ~2 hours mid-PoC checkpoint, ~2 hours closeout. ~6 hours total over the PoC window.

Mode B — Self-deployed

The customer takes the marketplace VM, deploys it in their own cloud account, integrates it with their own tooling (SIEM, ticketing), and runs the scan. HailBytes supports during the scan window: enablement session, mid-PoC sync, closeout package preparation.

Right for: evaluators who are also evaluating operational fit (not just findings quality), customers who want truer-to-production evidence, partners who want their own team to learn the platform during the PoC.

Customer time commitment: ~8 hours deployment, ~2 hours/week ongoing during the scan window, ~2 hours closeout. ~14–20 hours total over a 30-day window.

1. Findings report

Prioritized list of exposures and CVEs identified during the scan, with exposure narrative (why each finding matters in context), remediation guidance, and severity-band counts.

2. Asset Change Summary

Diff of what entered and exited the attack surface during the scan window. Useful for evaluators who care about discovery cadence, not just point-in-time inventory.

3. Attack-path chart

Visualization of reachability from external assets to critical infrastructure (databases, identity providers, internal APIs). Useful for security teams briefing risk to non-security stakeholders.

4. Compliance report

Findings mapped to one named framework: SOC 2, NIST CSF, HIPAA, GLBA, PCI-DSS, FedRAMP, NYDFS, CIS Controls, LGPD, ISO 27001, or GDPR. Additional frameworks on request.

5. Integration evidence

Screenshots and timestamps showing what HailBytes ASM pushed to the customer's SIEM, ticketing, or messaging tools during the scan. Demonstrates operational integration, not just import-export capability.

6. Recorded walkthrough

Video walkthrough of the platform end-to-end: discovery, scanning, findings triage, integration push, reporting. ~20 minutes; distributable to the evaluator's internal stakeholders who could not attend the live closeout.

7. Closeout document

Decisions made during the PoC, gaps identified (what HailBytes did not solve), recommended next step (PoC-to-pilot conversion, 10-tenant rollout, or post-PoC professional services). The document the evaluator hands to procurement.

Stage 1 — PoC to 10-tenant pilot

Validate operational fit at small scale. Confirm integration evidence is acceptable to internal stakeholders. Typical timing: 30–60 days after PoC closeout. Commercial mechanism: 1-year private offer (standard band pricing).

Stage 2 — 10 to 100 tenants

First material rollout band (Band 2). Multi-year commitment math first becomes worthwhile here. Typical timing: 3–6 months after pilot kickoff. Commercial mechanism: 2-year or 3-year private offer with band-2 pricing and 10–15% multi-year discount.

Stage 3 — 100 to 1,200 tenants

Large-enterprise scale (Band 3). Full white-label substrate typically engages here (ProjectQuota, /billing/projects/). Typical timing: 9–15 months after Stage 2 kickoff. Commercial mechanism: committed 3-year private offer at band-3 pricing.

Stage 4 — 1,200 to 5,000+ tenants

Negotiated band (Band 4). Custom unit pricing under a committed multi-year private offer. Typical timing: 18+ months after Stage 3 kickoff. Commercial mechanism: negotiated 3-year or 5-year private offer with custom unit pricing.