At some companies, "approved security vendor" just means the breach comes with procurement paperwork.