You are sitting in a conference room in Flower Mound watching a vendor demo. Nice slides. The rep says the product uses military grade encryption, guarantees 99.9 percent uptime, and blocks 100 percent of threats. Everyone at the table nods, because what else are you going to do. Nobody in the room owns a testing lab, and the guy is not going to hand you the fine print unprompted.
We get asked about these lines constantly, so we picked the three we hear most and ran them through the kind of evaluation you can actually do yourself. No lab coats, no benchmark numbers we invented. Just the published record, some arithmetic anyone can check, and a straight answer on which claims hold up and which ones are wallpaper. One of the three is more honest than people assume.
What A Real Evaluation Looks Like
Before the claims, the method, because the method is the transferable part. A claim is testable when you can restate it as a number, a source, and a consequence. Who measured it. Against what. Over how long. And what happens to the vendor if it turns out to be false.
Most marketing claims fail at step one. They are not false so much as unfalsifiable, which is worse, because you cannot argue with a sentence that does not mean anything. So the first move is always the same. Translate the slogan into something that could be wrong.
Claim One: “Military Grade Encryption”
Verdict: technically true and almost completely useless to you.
Encryption scrambles data with a key so that a stolen copy is gibberish without that key. When a vendor says military grade, they nearly always mean AES-256, and AES is real. The National Institute of Standards and Technology, the federal agency that sets measurement and technology standards, publishes it as Federal Information Processing Standard 197, defining the Advanced Encryption Standard with 128, 192, and 256 bit key sizes. It is a genuine, published, heavily reviewed United States standard.
Here is the problem. Every serious product on earth uses it, including the free ones. Saying your software uses AES-256 is like a restaurant advertising that it uses refrigeration. It is table stakes, not a differentiator, and “military grade” is not a technical grade at all. It is a phrase from advertising.
Worse, the slogan distracts from the questions that actually decide whether your data is safe. Who holds the keys. Can the vendor’s own staff decrypt your data if they want to, or if a court asks. Is the data encrypted while it sits on their servers, while it moves across the internet, or both. The cloud is just someone else’s computer, and the encryption algorithm is rarely the weak point. Key handling is. Ask about keys, not about algorithms.
Claim Two: “Blocks 100 Percent Of Threats”
Verdict: does not hold up, and independent testing has been saying so for years.
You do not have to take our word for this, which is the whole point. AV-Comparatives, an independent Austrian testing lab, publishes its Real-World Protection Test results publicly and for free. They run security products against live malicious web content on fully patched Windows machines, let each product use every defense it has, and report both what got blocked and how many harmless files each product wrongly flagged.
Read any recent round and two things jump out. The good products cluster very high, close enough together that the marketing difference between first and fifth place is mostly noise. And nobody posts a clean sweep. The top scorers miss a sample here and there, and the spread in false positives, meaning safe files wrongly blocked, is enormous between vendors. A product that blocks everything by blocking half your business software is not protecting you, it is just annoying you into turning it off.
So when a rep says 100 percent, ask which independent lab, which test, and which month. If the answer is an internal test, that is a vendor grading its own homework. The honest version of this claim is that top tier products catch nearly everything and the residual risk is real, which is exactly why backups and staff training still matter.
Claim Three: “99.9 Percent Uptime”
Verdict: mostly honest, and smaller than it sounds.
This one surprises people. Unlike the other two, 99.9 percent is a real number attached to a real contract, and reputable providers publish a service level agreement, or SLA, which is the document spelling out what they promise and what you get if they miss. That is more accountability than most marketing offers.
Now do the arithmetic yourself, because it is one line. A tenth of one percent of a thirty day month is about 43 minutes. Across a year it is roughly 8 hours and 45 minutes. That is a full workday of your email being down, and the vendor has still met the promise. Push it to 99.99 percent and the monthly allowance drops to about four and a half minutes. That single extra decimal place is the difference between an inconvenience and an outage your customers notice.
Two more things the slide will not tell you. Microsoft publishes its own recent worldwide uptime figures in its service documentation, and those published numbers have not always cleared the level people assume, which is a point in favor of vendors who show their work. And the remedy when a provider misses is usually a service credit, a partial refund of what you paid them, which has nothing to do with what the outage cost you. Nobody is reimbursing your lost Saturday.
How To Test A Claim Yourself
- Ask for the source, in writing. “Which independent lab, which report, what date.” A confident vendor sends a link within the hour. A vague answer is your answer.
- Check the free public testing first. AV-Comparatives and similar labs publish full methodology and results without a paywall. Twenty minutes of reading beats an hour of demo.
- Do the arithmetic on any percentage. Convert it into minutes, dollars, or incidents per year. Percentages are designed to feel small. Minutes are not.
- Read the remedy, not the promise. Find the section on what you get when they fail. If the answer is a credit worth a few dollars, the guarantee is marketing with a contract stapled to it.
- Pilot it on your own mess. Run a trial on a handful of real machines with your actual industry software. Vendor demos run on clean systems. Yours is not clean, and neither is anyone else’s.
- Ask what it does not do. Every honest engineer can answer this in one breath. A rep who claims no limitations is telling you they either do not know the product or are not going to be straight with you.
The Bottom Line
Two of the three claims dissolve on contact. Military grade encryption is true and meaningless. Blocking 100 percent of threats is contradicted by the labs that actually measure it. But 99.9 percent uptime is a fair promise honestly stated, and the failure is on our side of the table when we hear it as “basically never down” instead of “about a workday a year.” Vendor marketing is not all lies. It is mostly true statements arranged to be misread.
Got a claim from a quote you are staring at right now? Send it over and we will tell you what we think, whether or not you ever hire us. We do this for businesses across Denton County and the wider DFW area at https://harrisonward.com/contact/.
Comments are closed