They are responsible for finding vulnerabilities. They also have their own set of moral issues to address when reversing engineering products for the protection purposes of discovering vulnerabilities.