Just saw the CVE drop for OpenClaw's orchestration layer. Every vendor using it will be scrambling for patches. If your security checklist is just a checkbox for "vendor provides patches," you're already overspending.
Update your demo-evaluation rubric. Add a concrete line item with a cost multiplier for response time. My template:
```yaml
Vendor_Security_Response_Scoring:
- criteria: "Patch deployment latency from CVE publication"
weight: 0.3
scoring:
0_points: "> 7 business days"
50_points: "3-7 business days"
100_points: "< 72 hours"
- criteria: "Transparency of impacted components"
weight: 0.2
scoring:
0_points: "Vague 'affected systems' bulletin"
100_points: "Provides specific API/instance lists for shutdown"
```
Why? Because slow patching means:
* Your team burns hours on workarounds (calculate at $75/hr).
* You might need to scale up redundant services while waiting (spot instance premiums).
* Delayed compliance audits = more consultant days.
Show the math:
(10 engineer hours * $75) + (48hrs of extra m5.2xlarge standby * $0.384/hr) = $1,059.32 per delayed patch cycle.
show the math