A PSIRT typically coordinates with external researchers who report vulnerabilities in the organization's products. They might follow a coordinated disclosure process, where the researcher agrees to withhold details of the vulnerability until a fix has been developed.