What do pentesters looking for and what customers wish to receive in their reports?
Examples of easy account compromise.

What do pentesters look for the rest of the project time?
Classic OWASP checklist.

What are pentesters tired to report but still have to