You make a fair point, but I don't think it's an argument against what I'm saying. If for no other reason than what you stated about being paid for such open goals, he certainly is more productive than most consulting teams. And given his practice and experience at that sort of productivity, he's likely more capable as well.

I agree that security consulting results should be more open, but incentives are not really aligned for that to be the case.