Comment by argonaut

The fact that they had a specific team test their security is already evidence they aren't clueless.

Clueless would be refusing to have teams test your security.