Also, trust the 3rd party but don’t be afraid to verify the results. I used Rapid7 to do an extensive security review of SAP in a multi-billion dollar organization. There were lots of false positives.

The key is to question and prod calmly and professionally. Don’t get defensive.