You can usually google the thing and find an official link to the download and get a sense of whether it's a generally legitimate software company.
If it's an internal tool they've built, either make up a story about how you're temporarily on a machine where you can't install new software, or do it in a sandbox.
I'm not going to just blindly follow an executable download link in any circumstances. It's the same as if my bank calls me out of the blue and wants to confirm who I am with personal details, I'll look up their number online and call them back that way before proceeding. (Hasn't happened in a long time, but I do remember having to do that with a legitimate bank call ~15 years ago, when they called me and asked for my mother's maiden name before proceeding.)
If it's an internal tool they've built, either make up a story about how you're temporarily on a machine where you can't install new software, or do it in a sandbox.
I'm not going to just blindly follow an executable download link in any circumstances. It's the same as if my bank calls me out of the blue and wants to confirm who I am with personal details, I'll look up their number online and call them back that way before proceeding. (Hasn't happened in a long time, but I do remember having to do that with a legitimate bank call ~15 years ago, when they called me and asked for my mother's maiden name before proceeding.)