When you hire a security consultant / penetration tester to perform an evaluation of your security posture for a Security Best Practices assessment, you should be receiving a report at the end of the penetration test. This is a large part of the job. As well, there are automated scanners that you can use against your network or web application which will give you a higher-level overview on the overall posture of the network.
When you receive the report from the tester, it is generally going to contain an Executive Summary, which is meant to provide an overall debrief regarding the posture of your security without going too deep into technical details.
Often times, and for numerous vulnerabilities, the tester will be able to confirm the presence of the vulnerability though it may not be a vulnerability that allows for them to gain remote code execution. RCE (or "getting in") is only one part of a large array of vulnerability exploitation.