I have no idea what other consultants do. What I do: try to hack(penetration), propose ways to secure your app, explain risks and steps to be made..