+1. Even when being told (for money!) to do the right thing most pay the consultant fee but don't act. True story: A friend was pentesting a large company netw

+1. Even when being told (for money!) to do the right thing most pay the consultant fee but don't act. True story: A friend was pentesting a large company network in Germany, wrote his report and got paid. Years later, when being hired as head of IT security, he pulled out his old report and simply tried the default/easily crackable passwords he had discovered in the core infrastructure: They all still worked. If his section about "use jump hosts" was ever useful for the company, it was because someone had that page open by accident, needed a place to put down his mug of coffee - et voila: His report even made a difference!