vendor mitigations