The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.