There is only one thing that the "infosec" person can provide and that is evidence that Ben hired this person for those awful services you say were to be done, if that is not provided, then they are adding nothing at all, and so far there is no smoking gun...