The cheapest vendor review is the one you never start. When someone asks for a new tool, the most valuable question is often not “is this vendor safe?” but “do we already have something that does this?” Procurement teams know the answer is frequently yes. They also know they usually find out too late — after security has read the SOC report, legal has marked up the contract, and the requester has spent three weeks waiting for a tool the company already pays for.
This use case follows one request in the demo organisation, Northwind Labs, whose vendors are fictional: Sam, a requester, types “We want Gong for sales call recording, about 40 seats, roughly $60k a year, starting next month”. Before any review begins, the Intake agent answers: “You may already have this — Callwave is an approved CRM & sales vendor already — would it do the job?” What happens next is a procurement decision, and this post is about making it well.
In short
- Catch duplicates at intake, not after review. The Intake agent checks the vendor master, existing contracts and the category catalogue the moment a request is written.
- The warning is a question, not a block. “Would it do the job?” The requester, business owner and procurement decide.
- A duplicate often becomes a new use. Adding a use to an existing vendor (as with VR-0002, Zoom webinars for marketing) takes a lighter review than onboarding a new one.
- The approved alternative needs a look too. In the demo, Callwave carries 21 findings, a breach signal and a Renewal agent proposal to offboard. The duplicate check should prompt that conversation, not end it.
- Intake only knows what it knows. Discovery from Okta, Google Workspace and Entra ID is planned for 1.1; spend sync from NetSuite and Coupa for 1.2.
Why duplicate tools are a risk problem as well as a cost problem
Two tools that do the same job cost more than one. That is the obvious part. The less obvious part is risk. Every additional vendor that records sales calls holds recordings of your customers, needs a data processing agreement (DPA), has its own subprocessors, its own breach exposure and its own renewal date. Two call-recording vendors double the places customer conversations live. They double the number of SOC reports to read every year and the number of vendors to watch for incidents.
They also waste reviewer time where it is scarcest. A Tier 2 vendor that will handle personal data and integrate with the CRM triggers security, privacy, legal, finance, IT and business-owner lanes. If the request should never have become a new vendor, all six lanes have been spent on nothing.
data
SaaS management and procurement vendors regularly report, from their own customer data, that organisations run large numbers of SaaS applications with meaningful overlap in function, and that a share of licences go unused. The exact figures depend heavily on the sample and method, so treat any single number with care.
Sources: annual SaaS management reports published by SaaS-management and procurement vendors from their own customer data. Figures are vendor-reported and vary by year.
The request: one sentence
Sam does not fill in a form. Sam writes what is needed in plain words, as the console asks: which tool or service, what for, roughly how many people and how much. The Intake agent does the rest — names the vendor, the category, the data the tool will touch, the spend and the urgency — and proposes a request for Sam to check.
The Intake agent’s proposal
The proposal does three things at once. It fills in the fields: title “Gong — Record and analyse sales calls to improve sales team performance”, vendor Gong, marked as a new vendor. It lists what it could not tell, so that the lanes do not have to ask later: will Gong integrate with the CRM or other production systems through API or SSO; will any calls involve sensitive data such as payment details (PCI) or health information (PHI); who will own the Gong account internally; is SSO/SAML required; has Gong’s DPA been checked against data-residency requirements. And above all of that, in amber, it raises the duplicate.
The check runs against what InsightVendors holds: the vendor master, existing contracts and the category catalogue. Callwave is in the vendor master as an active Tier 2 vendor in the CRM & sales category, with a contract and 31 users. The match comes from category and purpose rather than the name, which is why a request for Gong surfaces Callwave.
Three honest outcomes of a duplicate warning. Each is recorded on the request.
Three outcomes, and who decides
The warning is deliberately a question. The agent cannot know whether Callwave does what sales needs; the people involved can. There are three reasonable answers.
| Outcome | When it fits | What happens in InsightVendors |
|---|---|---|
| The existing tool will do | Callwave covers the need; the request was made without knowing it existed | Request withdrawn or changed to additional seats; no new vendor, no new review lanes |
| The need is genuinely different | Gong does something Callwave cannot, and the difference matters | New-vendor request continues with the reason recorded; procurement can plan to consolidate later |
| The incumbent is the problem | Callwave is not working, or is not safe enough | The request becomes a prompt to review Callwave: renew, renegotiate or offboard |
In the demo, the third outcome is not hypothetical. Callwave’s own record is troubled. Its residual risk is 100. The Document agent raised 21 findings, including a critical “No data privacy or data processing obligations” in the MSA and “OpenAI listed as sub-processor — AI data exposure risk” in the DPA. Monitoring picked up “Callwave confirms credential-stuffing incident affecting a small number of accounts”, and the reaction was a re-assessment. The Renewal agent, at L1, proposed offboarding. Its contract notice date is 14 December 2026.
So the right conversation is not simply “use Callwave instead”. It is: we are paying $64,000 a year for a call-recording vendor whose contract lacks data processing obligations, which sends data to an AI subprocessor, which has just reported a credential-stuffing incident, and whose notice date is weeks away; sales now wants a second one. That is a consolidation decision, and it should be made once, with procurement, security, legal and the sales leader in the room — not twice, in two separate review queues.
Gong goes through six review lanes. Callwave renews by default. Northwind ends up with two call-recording vendors and two sets of recordings.
The duplicate warning links the two. Procurement, security and sales decide whether to keep Callwave with fixes, replace it with Gong, or keep both for a stated reason.
New use of an existing vendor
Not every duplicate is a competitor. Often the company already has the vendor and simply wants to use it for something new. InsightVendors treats that as its own request type. In the demo, VR-0002 reads “Marketing would like to add Zoom webinars for the Q1 launch” — a new use of an existing vendor, saved as a draft.
A new use matters because it can change the risk even when the vendor does not. Webinars for a product launch collect attendee registrations: names, emails, companies — personal data that a Zoom meeting licence for internal calls may never have touched. The review of a new use asks what has changed — data, users, integrations, spend — and routes only those questions. The vendor’s documents, findings and contract are already on file.
| Request type | Starting point | Typical review |
|---|---|---|
| New vendor | Nothing on file | Full triage: tier, inherent risk, lanes from routing rules, assessment |
| New use of an existing vendor | Vendor, documents, findings and contract on file | What changes: new data types, users, integrations; lanes only where the change triggers them |
| Renewal | Full history | Spend, risk trend, open findings, notice date; renew, renegotiate or offboard |
| Offboarding | Full history | Checklist: access revoked, data returned or deleted, contract terminated, supplier closed |
What this means for procurement savings
Procurement savings are usually discussed at renewal: negotiate the price, cut unused seats. Those matter. But the larger saving is often upstream: the vendor that was never added, the second tool that became extra seats on the first, the six review lanes that were never opened. Those savings are hard to see because they are things that did not happen. Record them. Each duplicate warning and its outcome is on the request, so procurement can report how many requests were redirected, at what requested spend, without inventing a number.
For the CISO
Fewer vendors holding the same sensitive data; fewer SOC reports to read; one breach exposure instead of two.
The duplicate check is also a chance to look hard at the incumbent.
For the vendor-risk lead
Lanes are spent on requests that should become vendors, not on ones that should not.
Every redirect is recorded with its reason, so the saving is reportable.
For the board
Spend under management grows more slowly than requests, which is the point.
Consolidation decisions are made once, deliberately, with the right people.
What intake can and cannot see
The duplicate check is only as good as the vendor master, contracts and category catalogue behind it. It will not find a tool someone bought on a credit card and never registered. Discovery from Okta, Google Workspace and Entra ID, which would show applications in use, is planned for 1.1; NetSuite and Coupa supplier sync and spend analytics are planned for 1.2. Category matching can also produce false positives: two tools in the same category may serve different needs, which is why the warning asks rather than blocks.
Does the existing vendor do the job? Ask the business owner of the incumbent.
Residual risk, open findings, signals, notice date. Callwave’s record changes the conversation.
Use the existing tool, proceed with a recorded reason, or review the incumbent.
Turn the request into extra seats or a new use of the existing vendor.
Outcome and reason stay on the request for reporting.
If both tools stay, set a date to decide which one remains, ideally before the next notice date.
What it adds up to
Catching a duplicate at the moment of the request is where procurement savings begin and where reviewer time is protected. It also brings a second benefit that is easy to miss: it forces a look at the vendor you already have. In the demo, Sam’s Gong request is less a question about Gong than a question about Callwave, and the system puts both on the table before anyone opens a review lane.
Before you review a new vendor, ask whether you already have one.
Catch the duplicate at intake, decide once with the right people, and let the request become a new use, a consolidation or a well-argued second tool — but never an accident.