My experience with all the certified security consultants is that they refuse to put any effort to understand the end risk of a security vulnerability on the pr

My experience with all the certified security consultants is that they refuse to put any effort to understand the end risk of a security vulnerability on the product that is being audited. For e.g. for many sites, it doesnt make sense to implement security features that are required by online banks. As an aside question for web developers: How many web developers encrypt/checksum all fields on the client-side?