@SecurityWriter Isn't it safe to say that most security audits happen because companies know they're terribly screwed, and are finally spending the money to find out just how screwed?

You may just be a victim of sampling bias.