This smells a lot like a pentesting report: pay people a lot of money to make a report, persevere with current bad practices, then when litigation comes up say "Hey, we took this seriously. Look at all the money we spent on this report!"