Turn every vendor claim into a request for a dated artifact. "We scan our code" becomes a scan report with scope and tool. "We patch quickly" becomes three recent cases from detection to deployment. "We are secure by design" becomes a design document and a list of defaults. If nothing exists, that is your answer.
Why claims are not evidence
Marketing language is cheap and unfalsifiable. Evidence has a date, an author, a scope and a way to check it. When a partner can produce evidence in a day, they have the practice. When they need three weeks to assemble it, they probably have an intention.
The translation table
| Claim | Evidence to request | What a good answer shows |
|---|---|---|
| "We scan for vulnerabilities" | Latest scan output, tool, scope, suppression list | Every repository covered, suppressions explained |
| "We patch quickly" | Three recent cases with dates | Detection to fix measured in a stated window |
| "We have an SBOM" | A file for a named release | The baseline fields, current build |
| "Our code is reviewed" | Branch protection export, sample merges | Reviewer differs from author, checks pass |
| "We sign our releases" | Verification instructions and expected identity | You can verify in minutes |
| "We handle vulnerability reports" | Disclosure policy, security.txt, sample acknowledgement | A named channel, a response time |
| "Our staff are trained" | Programme outline, completion dates | Role specific content, current dates |
| "We follow a framework" | Mapping with gaps marked | Honest about what is partial |
For related guides, see what to check on a security.txt file and how to verify signed releases.
How to judge an answer
- Is it dated? Anything older than a year needs a refresh.
- Is the scope stated? One product or all of them?
- Is it produced by the system or typed by a person? System output is stronger.
- Can you check it independently? Sample something yourself.
- Does it admit gaps? Mature teams do.
Words that deserve a follow up
- "Industry standard", "military grade", "fully compliant": ask which standard, which grade, which scope.
- A certification claim: ask who issued it, to whom, covering what, and for what period.
- "In progress": ask for the milestone date and what is done today.
Be careful the other way too. Do not demand audit grade evidence from a ten person team for a low risk integration. Match the request to the data and access involved.
A tiered ask
For low risk work, ask five or six items. For access to customer data or production, ask the full table. For acquisition, ask for all of it plus an independent scan with the seller's consent. This is not legal advice, and contract terms belong with counsel.
Try it yourself
Open the demo to see how a framework mapping links each control to evidence. Look at what a gap looks like and how it is recorded.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation collects records from scans, policies and gates, so claims have something behind them. A free scan is a place to begin.
Quick check
What if a vendor refuses to share evidence?
Ask why, and offer an NDA. Persistent refusal for low sensitivity items is a signal worth weighing.
Is a questionnaire enough?
It is a start. Sample at least a few answers with real artifacts.
Last reviewed: 19 October 2026.
