Security professionals express skepticism about the technical depth of penetration test reports from EY and other Big 4 firms, viewing them as superficial, automated scans that indicate a vendor...

{
  "signal_id": "58772c68-cf47-5898-a28a-8d3181d274c0",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-08-23T10:24:58+00:00",
  "company": {
    "name": "EY",
    "domain": "ey.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "penetration testing",
      "cybersecurity",
      "vendor risk management",
      "tprm",
      "compliance"
    ],
    "post_id": "1vw3klh",
    "summary": "Security professionals express skepticism about the technical depth of penetration test reports from EY and other Big 4 firms, viewing them as superficial, automated scans that indicate a vendor has a budget rather than robust security testing.",
    "category": "general",
    "comments": [
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5dszh7/",
        "depth": 0,
        "score": 12,
        "author": "Acceptable-Box-4400",
        "excerpt": "Big 4 reports usually mean the vendor has budget, not that they got tested well. I’ve seen too many that were basically a nessus scan with a fancy cover page\n\n The scope section is where I look first. If it’s vague about what was actually tested or says something like “performed automated vulnerability assessment” without manual exploitation details, I’m not giving it much weight\n\n Boutique shops",
        "posted_at": "2026-08-23T10:32:21.000Z",
        "author_url": "https://www.reddit.com/user/Acceptable-Box-4400/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5eakwn/",
        "depth": 0,
        "score": 3,
        "author": "DigitalQuinn1",
        "excerpt": "In our pentesting reports, we ensure transparency and traceability. For the scope we include all IP ranges, FQDN, etc. In the methodology section, we call out the frameworks that we actually used during test and map the findings to those frameworks. We include the team that did the test and their credentials. For the attack narrative, we show everything we’ve done so you can review step by step sp",
        "posted_at": "2026-08-23T12:34:53.000Z",
        "author_url": "https://www.reddit.com/user/DigitalQuinn1/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5f7g3s/",
        "depth": 0,
        "score": 2,
        "author": "AddendumWorking9756",
        "excerpt": "Do they give you the scoping questionnaire? An unauthenticated test against an app whose whole surface sits behind login is not a test, and that one line kills more reports than the logo on the cover does. After that I read for chains, since twenty standalone findings and no business logic issue means it was run rather than performed.",
        "posted_at": "2026-08-23T15:20:09.000Z",
        "author_url": "https://www.reddit.com/user/AddendumWorking9756/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5juprm/",
        "depth": 0,
        "score": 2,
        "author": "CyberOrbit-ai",
        "excerpt": "Honestly, most people give the logo too much weight and the evidence too little, so that's where I'd start.\n\n The Big 4 reports I treat as heavy on procurement weight and light on technical weight. They're often scoped narrowly and delivered by rotating junior staff to a fixed method, so what you get is a CVSS list with a nice cover page. I don't dismiss them, I just give the evidence the weight r",
        "posted_at": "2026-08-24T06:20:34.000Z",
        "author_url": "https://www.reddit.com/user/CyberOrbit-ai/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5e0bv6/",
        "depth": 0,
        "score": 1,
        "author": "strandjs",
        "excerpt": "Look at the methodology. Do they give findings? Or, to they give repeatable steps to validate those findings with the steps that led them to that conclusion.",
        "posted_at": "2026-08-23T11:28:09.000Z",
        "author_url": "https://www.reddit.com/user/strandjs/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5f9tvc/",
        "depth": 0,
        "score": 1,
        "author": "MountainDadwBeard",
        "excerpt": "Most pen test reports are checkbox/useless. Some of them just check website headers are configured, and list nothing else.\n\n If you read the scope of the report, some of them will actually describe a more thorough pen test and those are the ones I evaluate positively with some mild skepticism still for if they just copy paste the same report accross all companies.",
        "posted_at": "2026-08-23T15:31:05.000Z",
        "author_url": "https://www.reddit.com/user/MountainDadwBeard/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5fx7qd/",
        "depth": 0,
        "score": 1,
        "author": "AYamHah",
        "excerpt": "They aren't.\n\n You need a relationship with that team and a solid understanding of your own environment such that you know what to expect on these reports. If you're not consistently finding highs and criticals, and you know you have them (hint: you do), find another vendor.\n\n It's about the team, not the company. I've worked on Big 4 teams that were amazing, and some that were not. I've worked on",
        "posted_at": "2026-08-23T17:15:44.000Z",
        "author_url": "https://www.reddit.com/user/AYamHah/"
      },
      {
        "url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/comment/p5muc3j/",
        "depth": 0,
        "score": 1,
        "author": "recovering-pentester",
        "excerpt": "Can tell a lot via transparency of methodology and for thorough the replication steps are.\n\n Logo in the report means nothing other than budget as others have said.",
        "posted_at": "2026-08-24T17:02:38.000Z",
        "author_url": "https://www.reddit.com/user/recovering-pentester/"
      }
    ],
    "evidence": [
      "[post] How much technical weight do you actually give to a Big 4 pentest report during vendor risk assessments?",
      "[comment u/Acceptable-Box-4400] Big 4 reports usually mean the vendor has budget, not that they got tested well. I’ve seen too many that were basically a nessus scan with a fancy cover page",
      "[comment u/CyberOrbit-ai] The Big 4 reports I treat as heavy on procurement weight and light on technical weight. They're often scoped narrowly and delivered by rotating junior staff to a fixed method, so what you get is a CVSS list with a nice cover page."
    ],
    "virality": "somewhat_high",
    "post_date": "2026-08-23T10:24:58.000Z",
    "post_kind": "text",
    "post_text": "I’m refining our vendor onboarding / TPRM process and evaluating how we score the credibility of third-party penetration test reports.\n\nWe see everything from Big 4 firms (EY, KPMG, Deloitte) to specialized boutiques and automated scanner outputs. I’m curious about community consensus:\n\n- How much technical weight do you actually give to a Big 4 pentest report during vendor risk assessments?\n\n- Which boutique or specialized pentest shops make you feel confident a vendor’s application was truly poked at by skilled offensive pros?\n\n- Beyond the logo on the report, what specific details in the methodology or scope sections trigger immediate red flags for you?\n\nWould love to hear how other CISOs and SecOps teams grade these.",
    "sentiment": "negative",
    "subreddit": "AskNetsec",
    "post_flair": [
      "Compliance"
    ],
    "post_title": "How are other CISOs grading vendor pentest credibility during TPRM reviews?",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/AskNetsec/comments/1vw3klh/how_are_other_cisos_grading_vendor_pentest/",
    "entity_role": "vendor",
    "post_author": "InspectionHot8781",
    "upvote_ratio": 0.9473684210526315,
    "mention_count": 1,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/AskNetsec/",
    "total_upvotes": 17,
    "comments_total": 14,
    "total_comments": 14,
    "other_companies": [
      {
        "name": "KPMG",
        "role": "competitor",
        "domain": "kpmg.com"
      },
      {
        "name": "Deloitte",
        "role": "competitor",
        "domain": "deloitte.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/InspectionHot8781/",
    "signal_category": "feedback",
    "comments_included": 9,
    "products_mentioned": [
      "penetration testing services"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/58772c68-cf47-5898-a28a-8d3181d274c0 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"ey.com","limit":20}'