Just because you didn't find a vulnerability doesn't mean it doesn't exist.
You tell me. That's the all point of my argument.
Furthermore, it shouldn't be enough that you report a vulnerability but rather you should demonstrate knowledge of that vulnerability and the potential methods for exploiting it. Many people try to disregard vulnerabilities if they feel it's unlikely someone will reach it, an unfortunate decision for which many companies have suffered.
If a client is hacked using something you didn't report as vulnerable or worse, something that you reported as vulnerable and then were paid to fix, the excuse that the attackers were 'highly skilled blackhat hackers' does not generally keep the client. It matters very little to a client company whether they were hacked by someone highly skilled or not; their data has been exposed and their network is no longer trustworthy. In addition, their faith in your pentesting company is severely diminished if not altogether eliminated.
What if you don't find a vulnerability? That was the all point of my argument. Is my English so bad? [yes, it is!]
(
http://tech.slashdot.org/story/14/01/08/1421235/23-year-old-x11-server-security-vulnerability-discovered)
edit:
I wrote "If you find a vulnerability then the app is vulnerable; if you don't find any, then the app is secure".
What I meant is "If you find a vulnerability then [you tell your client that] the app is vulnerable; if you don't find any, then [you tell your client that] the app is secure"
I also wrote other posts that should clarify what I meant.
Basically, finding errors and vulnerabilities is an undecidable problem, unfortunately, so no human being or company should be able to find them all (with some reasonable assumptions).
