Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and hav

Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and have your developers actually check any results, and then go through an extensive box checking exercise that is incapable of handling any app specific context. In the worst case, they may recommend outdated or harmful practices that will actually lower security. For example, complex password rules and rotations instead of strength checking and password managers. This leads to users just writing things down since they can't memorize ever changing passwords. Or they may force you to install antivirus on systems that don't need it, even though antivirus systems have been shown to be full of security flaws that actually weaken system security when installed into privileged or sensitive subsystems. Paper security is distinct from genuine security. They overlap certainly, but paper security is not enough to make you secure.