Someone hired to do a security audit has a huge incentive to find security flaws- frankly, they'll get a better reputation for alerting the company to them. Fi

Someone hired to do a security audit has a huge incentive to find security flaws- frankly, they'll get a better reputation for alerting the company to them. Finding bad news when you're a security auditor is good. Someone hired to do an investigation like this has an incentive to downplay any results. If they agreed with the accusations, GitHub would either have to hide the results, or publicly say "Yeah, we think we were likely legally liable for a hostile and sexually abusive work environment". They would not be taking those auditors out for celebratory drinks. If the consultant says "Yep, you're in the clear", GitHub can announce publicly how great everything is. Finding bad news when you're investigating a PR disaster is bad.