Skip to content

SERVICES / 07

Vendor and framework due diligence.

The agentic trading vendor map is changing fast enough that a procurement decision made on a marketing site is a decision made on out-of-date information. This brief produces the independent read.


Audience
Incumbents · Builders
Engagement formats
F-01 · F-02
Typical duration
2–5 weeks
Outputs
Vendor / framework dossier · Comparative matrix · Risk register · Recommended action with rationale
Last reviewed
2026-04-10

The question

Procurement decisions in this stack are routinely irreversible — once a multi-agent system is wired through a particular orchestrator or MCP server, switching costs compound monthly.

Independent diligence has to cover the framework's architectural assumptions, the vendor's commercial trajectory, the security posture, and the regulatory implications of the integration.

This brief produces a written dossier with a recommended action and the rationale to defend it.

What this produces

  1. 01A written vendor or framework dossier scoped to the firm's intended use.
  2. 02A comparative matrix covering architecture, commercial, security, and regulatory dimensions.
  3. 03A risk register with severity grading.
  4. 04A recommended action — proceed, narrow scope, defer, decline — with rationale.
  5. 05A briefing of the recommendation to procurement or sponsor stakeholders.

How it works

Three methodology steps from the standing approach, scoped to this brief.

  1. 01

    Frame

    Read the regulator filings, the codebase, or the internal memo. Write the question that is actually being asked.

  2. 02

    Build the artifact

    The artifact named in Outputs, above. Working notes during the build are visible.

  3. 03

    Hand it off

    A meeting, not a link. Six weeks of follow-up Q&A is included.

What it’s not

This is not a paid endorsement or a vendor-funded analysis. Inclusion is not endorsement; depth is annotated.

This is not a contract review — see outside counsel for commercial-terms and IP review.

This does not include penetration testing or live security audit of the vendor's product.

Adjacent briefs


Begin

Send the question.

Contact form Schedule a 30-minute call