It's sad to see that most companies don't really care about security, they care about securing their own jobs by covering their ass. This pentest that you talk about sounds exactly like that, just enough to cover his-or-her ass when the shit hits the fan but doesn't solve the problem. "See, I followed procedures and got the audit, and we fixed the top 5 most critical things. It's not my fault. How were we to know that the hackers would break in using the 15th thing in the list?"
I guess there's not much we can do about this, it seems ingrained in our culture these days, at least in the larger corporations. I know a bunch of Big 4 public auditors and some of the stories I would hear sounded like outright fraud. I would point that out, and they would say "Public auditors aren't in the business to detect fraud. We are only supposed to ensure that whatever gets published is accurate." The same goes for the financial "controls" that were supposed to be put in place with SarBox. Higher-level directors are supposed to sign off every quarter or every year that certain financial procedures are done, but they robosign the forms because they don't care. It's only when the shit hits the fan and people start scratching beneath the surface that everyone realizes that nothing is actually working as it's supposed to.
I guess there's not much we can do about this, it seems ingrained in our culture these days, at least in the larger corporations. I know a bunch of Big 4 public auditors and some of the stories I would hear sounded like outright fraud. I would point that out, and they would say "Public auditors aren't in the business to detect fraud. We are only supposed to ensure that whatever gets published is accurate." The same goes for the financial "controls" that were supposed to be put in place with SarBox. Higher-level directors are supposed to sign off every quarter or every year that certain financial procedures are done, but they robosign the forms because they don't care. It's only when the shit hits the fan and people start scratching beneath the surface that everyone realizes that nothing is actually working as it's supposed to.