>I dislike any compliance document that requires paid & external vendors, so would love to see that factored out Yes I agree, although my my data might just be

>I dislike any compliance document that requires paid & external vendors, so would love to see that factored out Yes I agree, although my my data might just be bad/skewed, my experience as a `freelance-security-auditor` (just a side hobby). Ever time I reported a serious website vulnerability to a company. Most of the time, their initial response was "But we paid for pen-testing/sec-audits !" or something to that regard.