Hacking Skills Not Required: Your Vendor Security Programs are not a Secret