> That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest

> That's antithetical to how the computer security industry should work -- arbitrary certifications don't guarantee compliance or security, at best they suggest it. On the other hand, it is how computer security often does work. I can't count the number of times I've had to go through a listing of false-positive flags from some braindead OWASP checklist penetration/vulnerability tester.