Security audits are becoming more frequent and common, whether by choice or required for compliance, amongst companies big and small. These companies, in many cases, are hiring outside firms to come in and assess their systems to fulfill a requirement and check the box. The outcomes of the assessments vary from firm to firm, but do the results align? Does a successful assessment really measure how secure you are? Going through the security audit can be challenging and frustrating and leave the company with more questions than answers. It is important to understand common findings, what a script finds and what a true manual exploration can find. This talk will discuss findings found in the field during assessments that top scanners and scripts did not detect that led to partial or complete compromise.