Remember that the goal of most security/procurement questionnaires isn’t _security_ … it’s _conpliance_

Compliance is not security.

For buyers, they often just need to check a box so that they can maintain their own compliance obligations. They probably don’t care all that much about your security if you can check all the boxes.

Pen tests are a joke. You can get perfectly acceptable pen tests (from compliance perspective) done for $2k in less than a week and the testers will try to find a couple things but their goal isn’t to evaluate your app’s security. Their goal is to make you happy with the report you’re paying for (and you won’t be happy if it has a list of 100 security bugs)

Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.