> but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned.

It depends on which audience you want to reach when you want to advertise how secure your product/service is. Most people outside IT security have no idea what a penetration test is nor can they make sense of jargon-heavy post-mortems.