There is a large market for useless security work from companies that need to demonstrate that some kind of security activity has taken place but don't particul

There is a large market for useless security work from companies that need to demonstrate that some kind of security activity has taken place but don't particularly care about security as an "end". In these situations everyone is just "going through the motions", the PM who hired them, the pentesters, the devs who dutifully put pointless findings in the backlog, compliance people tracking stuff in their register... The only thing worse is not having a process at all.