>Auditors though, they are cooked.

I think you're massively underestimating the complexity and depth of a good security audit service.