I once billed $majorAustralianBank about $70k for time spent debugging (and proving to their IT team) that an edge router in their internal network was a Cisco

I once billed $majorAustralianBank about $70k for time spent debugging (and proving to their IT team) that an edge router in their internal network was a Cisco box that was running a specific (and well out of date) version of the OS that in default configuration was intentionally munging any STARTTLS commands that went through it, so all mail passing through was force downgraded to plain text across int internet (into their Microsoft Office hosted mail system). Nobody involved at $bank even knew of the existence of this router, and they spent several weeks not believing they even owned that model of Cisco gear or that they had any Cisco gear that wasn't fully updated. It was "fun times" debugging that and documenting/proving exactly what was breaking with no more access than sftp to a web server running non root privileged PHP. (We may have gone fairly dark-grey hat and broken quite a few internal rules to achieve that... Then had to "parallel construct" our investigation (before I even knew that term) to explain to their tech people haw we'd identified the root cause.)