Yes. This is the collective responsibility of all parties: Liferay regularly evaluates and publishes fixes for evolving threats relating to the software framework and any customizations under their direct control. Similarly, Omegabit is responsible to ensure that the environments under its management and control are maintained and regularly checked, monitored, patched, and configured to prescribed standards. And also to help educate and inform the Client on any related concerns or actions that may be required. And, it is also the responsibility of the Client to ensure that any customization or configuration inside the portal, which the Client affects or is the originator of, is thouroughly tested and maintained to standards, and to verify the integrity of its security controls inside Liferay for any and all customizations - this is particularly important during change release cycles where the underlying changes impact or relate to permissions or other key areas of security or functionality in Liferay.