“They were able to find vulnerabilities that we weren’t aware of, that we had a blind spot to. They were able to actually go beyond our initial discussed scope and also look at components that we have not looked at in the past.”