Software Lantern

What to compare before a vendor demo

Last updated: October 21, 2026

A demo tends to show what a remote-access product does well. The questions below are what's worth asking about directly, so the comparison covers what a demo doesn't always surface on its own. They are grouped under five dimensions of remote access governance (identity, scope, lifecycle, evidence and availability) plus fit and commercial, the same grouping as the regional report. This page doesn't name or recommend any specific product.

Identity

Whether every session is tied to one named person, with a second factor.

  • Is MFA mandatory for every connection, or optional and up to us?
  • Can two engineers share one login, or is every account tied to a named person?
  • Can this use an existing single sign-on, or does it need its own separate accounts?

Scope

What a connection can reach, and what it can change, once it is made.

  • Can access be scoped to one machine, or does it always reach more of the network?
  • How is one customer's access kept completely separate from another's?
  • Can file transfer and program changes be switched off per user or per machine, and is each one recorded?
  • What software or hardware has to be added to the machine, and who maintains it?

Lifecycle

How access is inventoried, granted, seen and removed when the reason for it ends.

  • Can we list every remote path to our machines through this, with an owner for each, and export that list?
  • How is access granted for a new engineer, and how quickly can it be revoked?
  • When an engineer leaves, what has to be done to remove every way they could connect, and who does it?
  • Can the customer switch off access themselves, without contacting us first?
  • Can the customer see, in real time, exactly who currently has access?

Evidence

What is recorded about each session, for how long, and whether you can take it with you.

  • What does the session log capture: keystrokes, a screen recording, or just connection times?
  • How long are logs retained, and can we export our own copy?
  • Can session and log data be exported into the monitoring tools already in use?
  • If this is stopped, can the logs and configuration be exported, or are they locked in?

Availability

Whether access exists only when it is needed and approved, and how it behaves when something fails.

  • Can a session be set to wait for approval from someone at the plant, and is that approval recorded?
  • Can the customer end an active session themselves, at any time?
  • Does an idle session close itself, and after how long?
  • How does emergency access work out of hours: who approves it, when does it end, and how is it recorded?
  • What happens to an active session if the connection drops, and does it work at all on a low-bandwidth link?
  • If your cloud service or our identity provider is down, can anyone still connect, and what happens to sessions already open?

Fit and commercial

Deployment, protocols, onboarding, support and price. Important for choosing, lower priority for governance.

  • Can this run entirely within our own network, or does it require a cloud component?
  • Which protocols and controller types does this actually support today, not on a future roadmap?
  • Does this work with the equipment already installed, or only with newer models?
  • Can access across every customer site be seen and managed from one place?
  • What does the customer actually have to do to get this running at a new site?
  • Roughly how long does setup take, from agreement to a first working connection?
  • What hours is support available, in what time zones, and in which countries is data stored and processed?
  • Is pricing based on users, sites, machines, or something else, and is that stated plainly?
  • Are there separate costs for support, extra users, or extra sites beyond the quoted price?

Ask to see it, not to hear about it

A claim in a meeting is not the same as seeing it work. Ask each vendor to run these live, on a system you direct:

  1. Revoke an active session
  2. Restrict access to one machine
  3. Remove a departing engineer end to end
  4. Reconstruct a past session from the logs
  5. Drop the connection mid-session
  6. Emergency access with approval and an end time
  7. Export logs and configuration

Get the full comparison checklist

A spreadsheet with all 31 rows above: why each one matters, what to ask, the evidence to request, what a weak answer looks like and default priorities by buyer type, plus three vendor columns with an evidence status, the demo script, and a summary of the evidence per vendor.

Get the checklist

Related guides

Remote access approaches for machines, compared and Preparing to answer a customer's security questionnaire.

Check your situation →

It takes about 2 minutes and covers NIS2, the Cyber Resilience Act, and the Machinery Regulation for machine builders, factory operators, and system integrators in the Netherlands, Belgium, and Luxembourg.

This is a general guide, not legal or security advice, and does not name or recommend any specific product. Confirm what fits your own situation with a qualified advisor.