Zero Security Theatre
Patterns and anti-patterns
Patterns are practices that help when tested. Anti-patterns are common, usually well-intentioned practices that create paperwork without improving the result.
Patterns
Attach an outcome test to every security purchase
Make a named production test a condition of acceptance and renewal. Run the attack behaviour, record what the control changed, and use the result in the buying decision.
Rehearse the out-of-hours call
Exercise every critical vendor escalation path on a schedule and record who answered and how long it took. An unexercised path is unknown, and unknown is red.
Anti-patterns
Our vendor handles that
This answer leaves out what the vendor sees and what it may do. Ask for the data received, the detections in place, the permitted actions, and the date the response path was last tested.