Wow, is that incredibly broken. I'm in security, doing testing for internal project teams. Another consultant is typically advising them on general controls, p

Wow, is that incredibly broken. I'm in security, doing testing for internal project teams. Another consultant is typically advising them on general controls, policy and such, and telling them to come to my group to get testing done. I think a large part of what we do is after the report, explaining what it all means, and how these various high/medium/low issues might be combined to create havoc with much more impact. Very low-key threat modeling is part of this, as someone else mentioned, story-telling. Really, it can be something of a mental pen-test, in that you've helped guide a narrative from where someone might discover issue A, leverage it to find B, and so on.