What should you bring?
Pick one control you know is weak, such as quarterly access reviews. Bring a real security questionnaire you received recently, with identifying details removed. Choose the framework you expect to add second. These three give you a test that matches your work rather than the vendor's showcase.
What should you ask the agent to do?
For evidence: connect a sandbox account or ask to see a customer-like environment, and watch the agent collect and assess evidence for your chosen control. For questionnaires: upload your questionnaire and watch it answered, then ask where each answer came from. For policies: ask for a policy draft for your weak control and check whether it matches your actual process. For remediation: ask what the agent proposes for a failing check and whether it produces code, a ticket or a to-do.
What should you watch for?
Note which steps a person on the vendor's side performs during the demo. That is not a problem, but it tells you whether the task is agent work or service work. Ask whether that person will be available to you, and on which plan. Check whether 'coming soon' features are shown; Scytale, for example, lists its AI Policy Generator as coming soon.
How do you close the loop with the auditor?
Ask to see the auditor's view: how evidence is shared, whether agent-generated content is labelled, and how the auditor requests more. Then add your second framework to the demo account and see how many controls carry over. That last test is the fastest way to see the difference between platforms on this site.
How do you score what you saw?
After each demo, fill in the same five rows as our work split: evidence, policies, questionnaires, audit management, remediation. For each, write whether you saw an agent do it, a person do it, both, or nothing. Then compare your notes with our dataset, which reflects only what vendors publish. Where your demo shows more than the public page, you have learned something the vendor does not advertise; where it shows less, ask why. Share the notes with whoever signs the contract, and keep them for the renewal conversation a year later.