Start with service fit
Ask whether the supplier investigates incidents involving AI systems, uses AI to assist conventional investigations, or sells incident-management software. These offerings can complement each other, but solve different procurement needs. Describe your workload and the business consequence you need help understanding.
Use this checklist to compare written proposals. It is not a ranking of named suppliers or evidence that a company lacks a capability. Atlant Security should be asked the same questions.
Ask for a demonstrable investigation approach
| Question | Evidence to request |
|---|---|
| Can you follow an agent action into a business system? | A sanitised explanation correlating a run, identity, tool and destination event |
| What if traces are missing? | Alternative evidence and explicit reconstruction limits |
| Who performs the work? | Named role, relevant experience and subcontractor dependencies |
| What containment can you carry out? | Written authority, change approval and customer responsibilities |
| How is recovery accepted? | A defined test and sign-off process, including residual risk |
| How is evidence handled? | Access, transfer, storage, retention and deletion arrangements |
Read mobilisation terms precisely
Ask what starts the contractual clock, which channel activates it, which time zones and hours are covered, and what happens when several clients need help at once. A response commitment may describe an acknowledgement, a first call or an investigator beginning work. Confirm the milestone rather than comparing bare numbers.
Without an existing retainer, ask about onboarding, conflicts checks, NDA, access approval and available capacity. A web form and booking confirmation do not establish those terms. See retainer planning.
Compare commercial scope and handover
List collection, investigation, containment, recovery validation, executive updates and final reporting separately. Identify provider costs, expenses and exclusions. Ask who approves extra work and what happens when the original question expands. Compare the work you receive, not only the hourly rate.
Have the relevant owner confirm insurer or legal requirements. Do not assume panel membership, privilege or admissibility from a badge or broad marketing statement. Our cost guide explains the variables to include.
Make the shortlist useful
Prepare the same non-sensitive scenario for each supplier: workload, observation, current status, impact and evidence availability. Ask each to explain its first scoping questions, proposed work products and dependencies. This makes differences visible without disclosing confidential evidence during initial procurement.
Discuss your situation
Build an incident brief with non-sensitive context, or request a scope discussion. We confirm people, access, fees and availability before work begins.
