Pray that you never have to enter domains where the security audits and assessments must be always done by an "approved supplier". We have had to cancel engage

Pray that you never have to enter domains where the security audits and assessments must be always done by an "approved supplier". We have had to cancel engagements with suppliers who I have thoroughly enjoyed working with, and whose results were nothing short of spectacular.[ß] And all of this because certain regulators had their rules written by an established auditing firm who managed to make sure that only a select few (less than 5 globally) companies can ever perform their required assessments. Regulatory capture through security auditing companies should deserve its own circle of Hell. ß: Have you ever had a pentest report you could forward directly to your engineering teams and be certain that they understood the contents accurately? I have. But I can't use the supplier anymore, because they do not enjoy a royal charter.