I thought you might find this interesting:

Trustwave is facing a lawsuit in relation to (and along with) Target because they allegedly failed to identify critical vulnerabilities that were leveraged by hackers during the Target breach (link provided below).  This is just another clear cut example as to why its so important to put your energy into selecting a genuine penetration testing vendor.


http://www.cnet.com/news/security-firm-trustwave-sued-in-connection-with-target-breach-report/

My two cents. I have used Trustwave for PCI services for 5 years now. They are the largest QSA organization out there and do complete the most assessments. This does not make them the best. The level of consultants who come onsite have little to no knowledge of systems or how an organization operates. I think there needs to be a more comprehensive testing program for both companies and individual QSA's to ensure companies are properly being audited. 

Send me your thoughts at jncsousa@outlook.com