IT Services mandated a pentest when we wanted to switch our corporate website to Drupal (as part of a battery of exercises intended to convince us to stay with

IT Services mandated a pentest when we wanted to switch our corporate website to Drupal (as part of a battery of exercises intended to convince us to stay with Interwoven Teamsite, which they paid a million dollars a year for). When we agreed, they supplied an external penetration tester with the Drupal superuser password and said, "See? Unsafe!" when the pentester was able to log in and put the site into maintenance mode. I suppose in the strictest sense they were correct: trusting IT with credentials did turn out to be a security issue.