I can't speak to your specific case, but I've seen a tool "pass" a billion-dollar company's auditing because the scanner they used never got past the login screen and their folks never noticed that fact.