All software companies need external security consultants when you go beyond a certain level of of forensic analysis; unless you dedicate completely to that field it's unlikely anyone has in-house staff for that.