And auditors don't really have access to passwords etc. They can run an assessment tool to see that there's an account named "admin," but typically don't get ac

And auditors don't really have access to passwords etc. They can run an assessment tool to see that there's an account named "admin," but typically don't get access to /etc/shadow or passwords within applications. Now a pentester? If they don't spot this during an assessment, they suck. But pentesting isn't always performed on a rigorous schedule.