How to Evaluate Software Vendors in 2026: A Risk-First Framework