In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.
Examples:
We do express grave concern at the overall security posture of that webserver and the possible exposure to
$client
In general, it is our feeling that
$client
is a low-profile, yet high-value target for attack. The public information available about the value of funds managed by the company combined with the number of 3rd party vendors and weakness of the company website might motivate an attacker, with awareness of the company.
Is that language appropriate to include?