I'm guessing that the company you're working for has concerns about the possible legal liability of doing security research on software that they don't own. Fo

I'm guessing that the company you're working for has concerns about the possible legal liability of doing security research on software that they don't own. For example, even if it is permitted under law, disclosing the vulnerability might violate the license under which the software is provided for their use. Since you're apparently not a lawyer, you're not really in a position to question the wisdom of these policies, and as long as you're working for this company, you have an obligation to protect their interests. If the company was sued by the software owner, you could be personally liable if you ignored explicit instructions to not disclose vulnerabilities.