Cyber providers are becoming much more savvy and are starting to decide that self-service 'yeah we are totally doing this' self-assessment checklists aren't suf

Cyber providers are becoming much more savvy and are starting to decide that self-service 'yeah we are totally doing this' self-assessment checklists aren't sufficient. I have around 20 financial institutions on my client list and 11 of them have had their first hands-on penetration test in the past year. A year ago they would just send a laptop with Nessus on it and then sign off on a risk sheet full of the usual llmnr/nebios/kerberoast/smb1 vulns because they didn't know what it meant. Now they will pop your domain administrator and refuse your renewal or jack your rates until you get a followup pentest demonstrating that those vulns have been resolved.