What happens when there's a breach?
You have to inform everyone who's using the system and you have to fix the breach. You might also be on the hook for anything which happened in your customer's systems due to the breach, but that's going to depend on a number of factors.
Am I allowed to use a 3rd party app to deal with my security problems?
Yes, but you're still responsible for the problems when they show up.
What happens when I was using a 3rd party app and they had a breach?
They have to tell you it happened and fix the breach. Of course, you were supposed to be responsible enough to be aware of potential problems as well, so it's hard to say if you're going to be able to ask for more than that if you were made aware when they informed you instead of being aware of it on your own.