That detail was likely being provided... but they don't tell the whole picture. It takes domain specific knowledge to actually understand the reports... and people tend to glance over the stuff that is bad or incomplete. PCI scans look great, but are often meaningless. Pentests by the...