I worked at Matasano for two years and did many tens of assessments. None even remotely approached 50% of the time spent on the assessment. I left there before

I worked at Matasano for two years and did many tens of assessments. None even remotely approached 50% of the time spent on the assessment. I left there before the Litany of Failure was completed. I did security assessments on my own and wrote something similar to Litany of Failure (I think it is better) and the thing is that you should be documenting as you go along so it is not such a painful crush at the end.