What should the board ask before buying a security tool?
Which risk it reduces, who will use it, and what it will not do. Ask the vendor and your IT team: which problem on our risk list does this address; who reads its output and when, including at night; how long until it is useful; what is the full yearly cost, including staff time; what data does it collect, where is that data stored and under which contract; and how do we leave and take our data with us. Ask for the limits in writing: a vendor that says what its product does not see is easier to trust. Prefer a trial on your own network to a slide deck. NetSenX has a Free plan with no time limit, publishes its prices and states plainly what a network sensor cannot see.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.