Now say you're a company hired to do an audit. Same incentives.

The hilarious thing is nearly all of these high profile hacks happen even after being audited.

There was one company I remember being called out as a suspect, but I can't find the name.

Also given (a) anonymity (b) ability to take cover amid so many other hacks, you could do this for a few years, slow down, and remain a top tier firm claiming the lowest hack rate.