By regularly auditing the security of key vendors and defining security requirements in contracts

Trusting every vendor without verification if they are cheap

By banning the use of any external software

By delegating software purchasing to the reception

By ignoring vendor security because it is not our risk