> Are these sorts of things something you can just buy and they'll go out of their way to give you a favourable report because you're the client? That happens.

> Are these sorts of things something you can just buy and they'll go out of their way to give you a favourable report because you're the client? That happens. I can't comment on Insight Risk Consulting, as I don't know that company. They write they had a previous audit from Cure53. That's a well known and very skilled security company and I would expect that you can't buy an "please ignore as many vulns as possible" report from them.