When you do a pentest what is your recommendation to the client on how to handle/interpret the report?
What I frequently see is that identified issues - especially issues related to self developed software - are not fixed properly. The easiest example is the XSS, which is "remediated" by s/// (replace exactly the XSS String from the report with nothing).
This fix is obviously not a good one - on the one hand because the XSS still exists and on the other hand because this bug is a clear indication that the concept of handling user input is not secure in any way. From my point of view this means that other XSS vulnerabilities are present even though I did not find them. Assuming that a tester finds all vulnerabilities is, in my opinion, unrealistic.
How do I get the client to think like this? E.g., I want the client to say "Oh, you found an XSS! We probably need some technology/process/architecture adaption... to get rid of this stuff as much as possible. Maybe let's use some web-framework and introduce a SAST solution."
I learned that the generic remediation text-blocks at the end of every report are not sufficient at all. What has proven quite effective are remediation workshops - basically discussing the results in a 2-3 day workshop and then supporting devs during implementation. Of course, only a small amount of customers are willing to pay for this (and I don't really have the resources).