Absolutely nothing you said in this post is true or valuable, other than your final sentence. You appear to be far too comfortable with lying to clients.
Compliance is not security.
For buyers, they often just need to check a box so that they can maintain their own compliance obligations. They probably don’t care all that much about your security if you can check all the boxes.
Pen tests are a joke. You can get perfectly acceptable pen tests (from compliance perspective) done for $2k in less than a week and the testers will try to find a couple things but their goal isn’t to evaluate your app’s security. Their goal is to make you happy with the report you’re paying for (and you won’t be happy if it has a list of 100 security bugs)
Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
In the process, you're reinforcing all my negative perceptions about the (non-existent) ethics of sales staff.
See the note in the original comment:
> Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
Ethical people don’t.
The original advice was that such “embellishment” was normal.
My response is that it’s only normal to unethical people.