There really should have been some kind of SLA clause in the contract that specifies the university gets back X% of their quarterly/yearly payment for each fals

There really should have been some kind of SLA clause in the contract that specifies the university gets back X% of their quarterly/yearly payment for each false positive they catch. Gives the vendor a good reason to avoid false positives, and the university a good reason to look for them.