Holding Pentester accountable for bad files on endpoint

Hey guys. We have a pentester that keeps putting files susceptible to log4j on their endpoint. This just came to the attention of Security.

This guy has a NUC and virtual environment to work in and therefore does NOT "need these files for work". How would you handle it if he kept redownloading these files to his endpoint (his department has an exception for some things which is why he is able to download).

I'm hoping the inital convo with …

attention bad cybersecurity endpoint environment files hey log4j nuc pentester security virtual virtual environment work