30-45 days is the vetting process for new vendors - this is an economic problem, says Paul Fulton #cybersecurity