6) If they claim "zero false positives!" or "zero false negatives!" don't deduct any points, just end the Zoom call.

7) Ask for examples of attacks the system missed and explanations as to why. Deduct points if they can't think of any misses or can't easily produce a story about their system's known weaknesses.

8) Now ask for a live demo where you control the inputs and test the system on both malicious and benign data. Give them some points depending on how their system performs on a test that you yourself have designed.

You don't have to know much about ML to use something like the system I'm pitching here. Just don't get intimidated by obfuscation attempts from the vendor (common tactic) and keep pressing for clear and convincing answers.

Also, what do you do when you have your final point count? Depends on lots of other factors, including the other tech that the vendor is selling with the ML system, and variables like price and the overall value of the technology in your ecosystem.