I'm still trying to figure out if a bad security audit is still better than no security audit at all. On one hand it forces me to look into the subject to explain why we don't need a particular security feature that was flagged as "missing", but on the other hand, ugh.