Security Assessment

Hand-in-hand approach

Goal isn't penetrate but to fully assess risk

Provide more detail about fixes

May look at process issues in addition to technical issues

Review policies where appropriate