Removing software is a relatively trivial matter, said Chris Morales, head of security analytics at security firm Vectra, but it can be an onerous process to select a new vendor.