It's not about the number of tools, vulnerabilities, open ports, checkboxes; it is about the value, impact, result, outcomes...