Sometimes it crops up in vendor review or similar. I've definitely found myself reviewing pen-test reports for exactly that reason without a lawsuit or discover

Sometimes it crops up in vendor review or similar. I've definitely found myself reviewing pen-test reports for exactly that reason without a lawsuit or discovery. Needless to say, having a bad pen-test report and then burying it would look extremely bad.