This is frustrating to read. The parent is telling the truth, I can’t give you my internal audits because they’re extremely confidential and sometimes a little bit shameful.

It also would affect business relationships which is something every employment contract I’ve ever signed has stated is something which is a violation of my employment terms.

So, to pile on a little: yes, the parent is right in a lot of cases, there are exceptions, but of 12 audits maybe 10 were essentially Nessus version checks. This was needed mostly for rubber stamping.

I'm not disagreeing with you. There's lots of companies doing crap work and lots of companies that need only the compliance checkmark and hope for crap work with no hard-to-fix findings. It's sad, but that wasn't even my issue. I think it's an issue when people start the expectations from the other side: if you had a security audit, it was just a rubber stamp. It's unfair to people who may have invested time and money in a engagement. It doesn't help people who want to run a good audit and hear that it doesn't exist.

Better ways to say the same thing without undermining people's trust in the whole idea: There are lots of scammy security audit companies, Confluence should make sure to engage a good quality ones. Companies should invest in serious pen tests rather than just org compliance for security. Here are companies that actually did a good job...

Unless the goal is to bury the whole idea under a list of issues with bad actors and make sure nobody knows there are alternatives?