My company paid $$$ for a pen test to satisfy some contracts. The end result:
"I think I finished testing, no new vulnerabilities were identified. The features and functionalities that application has are perfectly validating attacking chances."
Not gonna lie, feeling kinda badass this afternoon.