That is why it is important the reports from security audits include what was looked for and at least a little detail about how. If they were appropriately tho

That is why it is important the reports from security audits include what was looked for and at least a little detail about how. If they were appropriately thorough and all they found were low-hanging fruit, then that is a good thing. Of course a detailed report is no absolute guarantee: we once had a test done that I think was more than shoddy: there was not nearly enough activity on the web server over the testing period for the amount of automated work they claimed to have done, and I spotted an issue a couple of weeks later that at least one of their documented processes really should have picked up on. That company is no longer in business thankfully.