HECVAT: a powerful tool to assess the security chops of your prospective vendors