PROTIP: If you don't know what you're selling *dramatic pause* TALK TO SOMEONE WHO KNOWS FIRST, OR DON'T FUCKING SELL IT.
Sales idiot: ZOMG I SOLD A PENETRATION TEST TO $CUSTOMER! IT NEEDS TO BE DELIVERED BEFORE THE END OF THE MONTH!
Me: Didn't I say that everyone should talk to me about any security work before it is sold so we're delivering the right service, scanning appropriate targets, and not making ourselves look bad?
SI: YEAH BUT $CUSTOMER WANTED THE TEST SO I HAD TO SOLD IT LOL
Me: Isn't that the new customer that we've been fixing for the past three weeks, and are not yet done fixing? Why would we test a network that we know is incomplete?
SI: I DUNNO LOL $CUSTOMER SAID HE NEEDED THE REPORT TO STOP HAXORS AT TEH INTERNET!
Me: I really need to review what the customer has before recommending security work. What are we going to do if the report is blank, or finds problems we're in the process of fixing?
SI: BUT HE WANTED TO PAY MONIES FOR IT SO I SAID YAH LOL KACHING! WHOOO WHOOO!
Me: You're not understanding me...
SI: IT'S ALREADY ON MY FORECAST SO TAKE IT UP WITH THE CEO!
Me: That's not the point, if we don't do this right we can get burned if we give them a clean report and they get compromised again. Strictly from a CYA standpoint, we need to do a number of things to make sure the hacker doesn't get back in, and destroy all the work we've already done!
SI: ITS 3 O'CLOCK AND IM EXHAUSTED FROM MY 3 HOUR LUNCH SO IM LEAVING FOR THE WEEK. SEE YOU TUESDAY!
So, big fucking surprise, the report's empty because there are NO OPEN PORTS! That's gonna look pretty damn good to the customer. Especially considering this provides a snapshot of the current externally-facing network status which we are in the process of CHANGING FOR THEM.