Where to find reliable vendors?

Hi there folks,

Here is the context: I am pretty much the only appsec lead at the company at the moment.

Have done it for few years but was relying on the decisions made by the earlier members of the team for the selection of tools.

Now I have a clean slate and I am building the program from scratch.

I feel security industry is going through a rapid change in itself with the advent of AI with some snake oil and some good tools, there are way too many open source agents to help with threat model or red team or soc or log analysis- the noise is maddening.

For those who have experience building tools, how do you quickly judge whether a vendor is good? Where do I find those?

I don’t want to do sales calls or pocs - need to set up in short time so what places should I look at, and how to know which tools are performing the best for different functions of the appsec program.

I have previously been part of programs where we used the typical security review, sast, dast, sca, container scanning, threat modelling and pentesting but I am kinda rethinking how to setup a brand new program.

Any suggestions or useful resources are welcome!

TIA