Penetration testing report from a "highly respected" security company:
* 20 pages of risk assessments, methodology discussion, tables, charts and other nonsense
* conclusion: "this report does not include any findings"
🤦♂️
@kravietz i once got a feedback for a malware scan I did, where they told me that it was suspicious because ** BEfOrE yOu dId tHE scAnN we NeVer haD pRobLems**
Fantastic approach... 🤦♂️ Actually, I've seen that a lot with penetration testing or SAST tools. With the latter it's partially justified by the fact that a scanner that is not tuned will instead flood the dev team with tons of irrelevant findings...
