Step 2: Are the Results Real?
Things are seldom what they seem
- Deceptions just like vulnerabilities seem
- !!! Another Shameless Plug !!!
Scans are of highly limited applicability
Demonstrations are good at scaring management
Friendly expert assessment is best in my view
- Backed up with some validation testing