If you don’t get satisfactory answers to these questions, you’re likely buying tech-debt and security risks disguised as software.