Quick Vendor Review Checklist

Informative Appendix (non-normative)

This checklist gives customers, CISOs, procurement teams, and security reviewers a short path for screening autonomous pentesting platform operators before a deeper APTS review. It complements the Vendor Evaluation Guide, Evidence Request Checklist, Checklists, and Customer Acceptance Testing. It does not replace the full APTS requirements or create a certification process.

Use it when you need to decide how much additional review is warranted:

• 30-minute screen: identify obvious gaps and decide whether to continue
• 2-hour review: inspect the minimum evidence needed for a procurement or risk decision
• Full review: perform a deeper APTS-aligned assessment for higher-risk deployments

Before the Review

Collect these basics from the operator:

30-Minute Screen

Use this screen to decide whether the operator is ready for deeper review.

30-Minute Decision

2-Hour Review

Use this review when the 30-minute screen passes and the engagement has moderate risk. Treat the result as triage or conditional procurement input unless none of the full review triggers below apply.

2-Hour Evidence Pack

Ask for a small evidence pack before scheduling detailed demos. This pack is a prioritized subset of the broader Evidence Request Checklist:

Evidence Quality Checks

For each artifact, verify that it is current, representative of the reviewed deployment mode and autonomy level, and cross-checkable against another artifact such as an audit log, checklist row, evidence manifest, or demonstration recording. Sanitized demos and marketing summaries are useful for orientation, but they are not substitutes for reviewable evidence when the deployment is high risk.

Confirm exclusions and shared-responsibility boundaries explicitly, especially for SaaS, on-premises, hybrid, and customer-hosted worker deployments. Customer responsibilities can materially affect the risk decision.

Suggested 2-Hour Agenda

Full Review Triggers

Move beyond the quick review when any of these conditions apply:

• The platform will test production or critical systems
• The operator claims Tier 2 or Tier 3 conformance for regulated environments
• The deployment uses L3 Semi-Autonomous or L4 Autonomous operation
• The platform deploys agents or workers inside customer infrastructure
• The engagement may encounter sensitive data, credentials, or multi-tenant systems
• The customer needs audit evidence for regulators, insurers, or internal governance
• The 30-minute or 2-hour review identifies unresolved red flags

For full review, use the Vendor Evaluation Guide, per-tier Checklists, and optional Customer Acceptance Testing.

Decision Record Template

Common Red Flags

• The operator cannot state the claimed APTS tier or claim scope
• Scope is enforced by policy or operator judgment only, not by pre-action checks
• The kill switch cannot be demonstrated in a controlled environment
• Critical findings are reported without human review or reproducible evidence
• Evidence packages contain summaries but no raw artifacts, hashes, or provenance
• Model versions and provider dependencies are described as "latest" or "proprietary" with no change log
• Customer credentials have unclear ownership, retention, rotation, or revocation procedures
• Customer-hosted agents have broad permissions or no documented removal path
• Incident notification timelines are undefined
• The operator treats APTS as a certification without explaining the assessment method

Output of a Quick Review

A quick review typically produces one of four practical outcomes:

Document the decision, evidence reviewed, unresolved questions, and next review trigger. Revisit the decision when the operator changes deployment model, autonomy level, foundation model, safety controls, or incident response process.