Security Tool Intake Screening (Onboarding)

Security Tool Intake Screening (Onboarding)

1. 01

   Classify the tool by the security function it actually performs before any trial begins

   Sort candidates into threat detection, vulnerability scanning, access management, media authenticity, or policy enforcement. A tool that claims several functions at once needs separate evaluation criteria for each.

2. 02

   Verify the vendor's autonomy claims against a written definition of an agent

   Ask whether the product sets sub-goals and executes multi-step tasks without continuous prompting, or whether it is prompted generation wearing an agent label. Forrester's October 2026 research found most marketing AI agents fail this test, and client buyers are starting to ask the same question.

3. 03

   Map every system the tool can read, write, or act upon

   Include client CRMs, ad accounts, repositories, and shared drives. A runtime governance layer such as Vaultak exists precisely because agent actions can be reversed after the fact, which only helps if you know which systems were in scope.

4. 04

   Run a credential and dependency scan on the tool's own integration surface

   Scanners like Sentrint flag hardcoded secrets and exploitable code paths in repositories; point the same discipline at any SDK or API key the vendor asks your agency to install.

5. 05

   Confirm the vendor publishes an independent audit or a dated security disclosure

   Anthropic granted METR employee-level access to its models in October 2026 and waived the right to block publication. Treat that as the emerging bar: a vendor that will not submit to outside review is a vendor whose claims you cannot resell to a client.

6. 06

   Test the tool against a synthetic client scenario in a sandboxed environment

   Replay a realistic deliverable, such as a campaign asset or a data export, and watch what the tool touches. Record every outbound request so the review has evidence rather than impressions.

7. 07

   Score liability exposure and set the contractual boundary before signing

   Write the limit of what the agency warrants into the client retainer language: detection coverage, response time, and no promise of absolute security. Evolving attack surfaces make absolute guarantees indefensible.

8. 08

   Log the intake decision with the evidence trail attached

   Store the classification, sandbox findings, and audit status in one record so the next reviewer inherits facts instead of re-running the whole screen.