Strategies for Receiving and Reacting to Third-Party Security Exposure