Actually $9500 isn't outrageous, especially when you consider it's 23 servers..... Tht's not actually bad if they do a good job.

What I like to do when being audited is have a snort box ready and have them tell you the IP they are coming from..... Then log the lot. Afterwards go through it and see how thorough they were and report it to your Boss. It's good for him to know whether he got what he paid for or not.