I have done a number of vulnerability assessments and I'm noticing a trend. In the first assessment the clients are impressed and grateful for the massive security holes I find. During the second and third assessments, they feel frustrated because they were hoping to get a "clean report" that they could tuck into their marketing package and brag about to their potential clients. 

Even though they are doing a good job in mitigating the issues, the problem is that I'm better at my job so I always find more. On top of all that, there is no such thing as perfect security. I believe the only "clean report" is one where the assessor didn't dig deep enough. By the very nature of vulnerability assessments, I'm working against them - and yet I run a business and I need to find a way to work with them at the same time.

I also pride myself at being very helpful in teaching developers how to mitigate issues. The reality is that more often than not the theory doesn't get translated into practice. The developers cite tight deadlines and tight budgets from their management. I know the industry so, it's not hard to believe.

This puts me into awkward situation. Clients are scared to do an assessment with me because they feel they are not ready and haven't patched enough. They are (rightfully scared) of what I will find. Some even tell me "don't go so deep this time, ok?". And because I don't want to lose their business I find myself holding back my full abilities. Needless to say, this rubber stamping is not fun at all. It may be profitable, but not fun.

I'm also worried that this will backfire because inevitably someone else will re-assess what I did and find massive holes. They they will conclude that I have no idea what I'm doing because I missed such obvious flaws. Reputation is everything in this industry, so this is a big risk.

One solution that I can think of is that I keep finding fresh clients and staying away from 2nd and 3rd assessments. Finding fresh clients is something that I find frustrating and inefficient. I like repeat business where my relationship gets deeper over the years. It's the long term relationships that I enjoy in my business. The closeness is what creates the problem in the first place. Has anyone found an alternative where you can keep exposing never-ending flaws while keeping a client happy? Or am I just dreaming?

The other solution I tried is restricting scope. If I only test a small part of the stack, the client could get what they are looking for: a "clean report". But it's rare that they agree to that. They usually want everything tested. They can't have the cake and eat it too, but I have trouble communicating that to them.

I think I know the answer to my own question. I'm just wondering if I'm missing something here or if this is just the way it is and I have to deal with it.