Product vs Platform vs Service

This question asks you to categorize what you're selling. A 'product' is typically software that customers use directly - like a project management tool or CRM system. A 'platform' provides infrastructure or tools that others build upon - think AWS, Stripe, or Twilio. A 'service' means you're doing work for the customer rather than giving them tools - like managed IT support or consulting. Many companies offer combinations, but this question wants to know if there's any product or platform component, as these require different security evaluations than pure human services.

Your answer fundamentally shapes the security review process. Products and platforms undergo technical security assessments focusing on code security, infrastructure, and data protection. Pure services face different scrutiny around personnel security, process controls, and professional liability. Products and platforms typically require more extensive security documentation, regular penetration testing, and ongoing vulnerability management. This impacts your operational costs and the expertise needed on your team. However, products and platforms also scale better than services, offer higher margins, and create more defensible market positions through technical moats.

The main pitfall is misclassifying your offering. Managed services that include proprietary software are products, not just services. Another mistake is thinking that using third-party infrastructure makes you a service rather than a product - if customers interact with software you've configured or customized, you're likely offering a product. Companies also forget that even minimal software components trigger full product security requirements, so be prepared for technical security reviews even if software is a small part of your offering.