Again, that's not the same, because then they will look for problems. What you want to test is that they're looking for problems all the time, on every patch, without you telling them to do so.
If they don't, then that's the vulnerability in the process.
If they don't, then that's the vulnerability in the process.