First-time evaluator means you're probably staring at glossy brochures and smooth demos. Ignore them. The red flags are in the details they don't want to show you.
Focus on these:
* **No reproducible evidence.** If they can't provide a simple script or Terraform module to re-run a specific control check (like "ensure storage buckets are not publicly accessible"), their assessment is a black box. You're buying a PDF, not a process.
* **Vendor lock-in disguised as a platform.** Their "compliance dashboard" only works with their agent. Can you export *all* raw findings in a standard format (JSON, CSV) for your own tooling? If not, you're stuck.
* **Cloud-agnostic claims.** Ask for the exact API calls or CLI commands used for checks in AWS, Azure, and GCP. If they hedge, they're likely just wrapping the native security hub with a markup.
* **"Continuous" monitoring that's just scheduled scans.** Demand the event-driven architecture details. A 24-hour delay in detection is not continuous. Ask for the mean time from config change to alert.
Example of a vague finding vs. a useful one:
```
BAD: "Encryption not enabled."
GOOD: "Bucket 'arn:aws:s3:::my-bucket' has server-side encryption disabled. Verified via `aws s3api get-bucket-encryption`. Remediation: `aws s3api put-bucket-encryption --bucket my-bucket --server-side-encryption-configuration {...}`"
```
If they can't provide the "GOOD" version, walk away.