It seems that he pointed out a security vulnerability in your infrastructure - something you do have control over. And if a vulnerability is found in an extern

It seems that he pointed out a security vulnerability in your infrastructure - something you do have control over. And if a vulnerability is found in an external service you use, do you feel that you don't have a responsibility to mitigate the risk posed by the service whether or not you have direct control over it?