Run a compliance platform demo from your own script, not the vendor's. Send the same agenda and a description of your stack to each vendor, ask them to show real workflows rather than slides, and score each on the same sheet. That makes vendors comparable and exposes gaps a polished tour hides.
Send this ahead of time
Share one page with each vendor:
- Frameworks you need and the target audit date.
- Your systems: identity provider, cloud, code host, ticketing, HR, device management.
- Team size and who will own the tool.
- Your top three worries, such as evidence freshness or auditor workflow.
Tell them you will ask to see a live environment, not a recording.
The sixty minute agenda
Minutes 0 to 10: your stack. Ask which of your systems connect natively, and which controls fall back to manual work. Ask for the permissions needed.
Minutes 10 to 25: one control end to end. Choose offboarding or access review. Ask them to show the requirement, the test, the raw evidence, and what happens on failure.
Minutes 25 to 35: the failing case. Ask how the tool shows a failing control, who is notified, and how it is closed. Failing cases show more than passing ones.
Minutes 35 to 45: the auditor view. Ask to see what an external auditor sees, including filtering by period and sampling.
Minutes 45 to 55: leaving. Ask them to demonstrate an export of policies and evidence.
Last five minutes: open points. Collect everything they could not show, and ask for written answers.
Score on the same sheet
Use a short sheet with the same rows for every vendor: connected systems, depth of evidence, failure handling, auditor view, export, and fit for your team size. Rate each from one to three straight after the call, before memory blurs them.
Record unanswered questions as "not shown," not as "yes." That keeps the sheet honest.
Common demo tricks to watch for
- Sample data that makes everything look green.
- Features shown that belong to a higher plan.
- Roadmap items shown as if they were available now. Ask: "Is this generally available today?"
- Avoiding the exit question.
For similar scripts in other categories, see appsec vendor demo script.
After the demo
Within a day, send each vendor a short list of the points they could not show and ask for written answers. Compare the replies side by side. Vendors that answer clearly and admit limits are easier to work with later than those who reply with marketing copy.
Then involve the people who will use the tool daily. A security lead may like one interface, while the person who chases evidence each week may prefer another. Their view should carry real weight in the final scoring.
Where Safeguard fits
Safeguard offers compliance and evidence automation. You can run the free scan at gold.safeguard.sh/scan on your own repository, which is a quick way to see real output instead of sample data.
Try it yourself
Open the demo as a model of what to ask a vendor to show. Look at how a requirement links to a control and its evidence.
Click through it at your own pace, or open it full screen.
Quick check
Why ask for a live environment?
Recordings and slides can show features that are not available on your plan or that behave differently on real data.
How many vendors should I demo?
Two or three is usually enough. More adds work without adding much information.
Last reviewed: 19 October 2026.
