The spam is bad, but often I don't think they know what the results mean.

I love the spreadsheet I get every month. Just a list of vulnerabilities instead of anything curated. We noticed 5 vulns in an installed version of Firefox. Better list it 5 times just in case.

A few times now there were connections from some malicious IPs on our mail server on the mail port, and I was asked if we could block inbound connections. Open ports are a vulnerability, you know?

Never mind that the firewall already blocked that connection in particular.

Cybersecurity seems to be rife with people who did some sort of bootcamp or cert or associate degree and who don't really seem to understand what's going on. It seems to attract people who consider writing code too complicated for some reasons. So you'll get all these "best practices" and "vulnerability analysis" but no understanding beyond "I ran this tool and here are the vulnerabilities it found".

From my experience, hiring for these roles is like trying to find a needle in a haystack.