@dalias No security consulant will ever be able to charge as much for saying "your system is secure enough as it is" as for saying "your system needs a lot of security improvements." Especially since they'll be able to reject liability in case they make recommendations that end up not being implemented, no matter whether those are practical or cost-effective.