You should ask security vendors about practical scenarios, such as how their tools handle famous vulnerabilities like Figure.js, Event Stream, and Lettpad. Also, inquire about their proactive and reactive measures and how they can prevent future incidents.