Hearing that your product or service has security flaws from a third party can be hard to hear. A natural, human reaction is to perceive it as criticism, which often generates a hostile or antagonistic reaction to the third party. How do we get beyond this, particularly for those outside of cyber?