vetting cybersecurity vendors