Vulnerability report of Appian

I'd refer them to Appian's publicly-verifiable FedRAMP certification, honestly.  I understand how folks who are unfamiliar with Appian might have doubts, but I don't know what your company's security team thinks they'll uncover from these vulnerability reports that hasn't been reviewed by the multiple US federal government organizations that already use Appian.  Though if you get in touch with the Appian sales department, I assume there are more details they can provide your internal folks that will provide specifics and reassurance.