vetting security vendors