For consumer wares we are talking about an inspection, not a pentest whether or not they conform to basic security (SSL, update mechanism in place, salting and

For consumer wares we are talking about an inspection, not a pentest whether or not they conform to basic security (SSL, update mechanism in place, salting and strongly hashing passwords). This is a pentest. Whether you call it something else is irrelevant. Moot because I specified earlier we are not talking about full pentesting. But even if not, first force EVERYONE to get it, drive up the prices, then people will start learning it and drive done the prices heavily and start to automate. Look at web developers. Once prized, now a dime a dozen (compared to before). Pentesting is no different from anything else, it can be tiered, the lower tiers more and more automated and pressed into frameworks. This isn't true. Pentesting is fundamentally different from programming, in ways that are subtle and non-obvious. It's not something that can be automated, for the same reason you can't determine whether an arbitrary program will halt.