Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect agai

Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect against even commercial attacks like that is hopeless against state actors. You are correct that you will find all the standard cybersecurity companies in that hopeless pile. As for how you can evaluate on your own, look for positive evidence of security, not the absence of negative evidence. The standard belief is that everything is easy to hack, just ask literally any programmer, any claim of security is a extraordinary claim. It is a mystery why everybody then gets amnesia when a company claims to protect you and not only fails to present extraordinary evidence for such a extraordinary claim, but no evidence at all beyond marketing fluff. Demand positive evidence of protection from state, or at the very least moderately funded commercial, attackers. Serious penetration tests by teams of professionals with months to work on it that consistently fail to find any entry. That is a good starting point. Any proof less than that fails to even meet the standards of ordinary evidence, let alone extraordinary. If you want to go further you can look for design audits, formal specifications, and formal proofs as demanded by certification standards like the SKPP. In contrast, certainly ignore any certification or certification level that consistently certifies known garbage like the aforementioned cybersecurity companies. A bar that consistently passes garbage is not a certification worth a damn. Anybody presenting a option that does not meet those requirements should be soundly ignored until evidence is provided. And yes, that applies even if nobody reaches the minimum bar. You do not claim somebody has cured cancer just because they are the best so far. You do it when they cure cancer.