> “They want us to be compliant, not secure.” Suppose the auditor looked at the output from the author's single test and said, "Oh, ok, you're good to go." In

> “They want us to be compliant, not secure.” Suppose the auditor looked at the output from the author's single test and said, "Oh, ok, you're good to go." In this version of history, perhaps the author's organization saw a moderate benefit from the more resilient crypto. However, the set of all organization audited would be significantly less secure because the audit becomes nearly meaningless.