I have used some of your employer's software.
I do not disagree with your points, but the NCC audit is not compelling. They only interviewed engineers and didn't audit the code or how it is deployed.
I do not disagree with your points, but the NCC audit is not compelling. They only interviewed engineers and didn't audit the code or how it is deployed.
You are inaccurate on "they only interviewed engineers". There are document reviews as well which covers design and architectures.
Source of the report on methodology shared such information.