They likely had a compliance box to check and a limited number of approved vendors.

For the use case of enterprise network monitoring and alerting, with integration of netflow and DB or application-level stats, there are very few effective competitors. HP OpenView probably exists in some hopelessly outdated form under a new name, but every other NMS seems to involve baking a lot of custom scripts or else is cloud-centric.

They noticed funny traffic. And then did their due diligence by contacting both the vendor and a third party to investigate it. The investigation turned out fine.

What else would you do? "We found suspicious traffic but ultimately couldn't substantiate wrongdoing, should we torpedo the whole contract sir?"