 Even the simplest of testing can help an organization very quickly identify very obvious holes. Most contractors are going after the easy pieces. Organizations who haven't been patching their systems, who have weak passwords, who are not using protective measures like multi-factor authentication. Most organizations are going to be impacted by something fairly simple, but also simple to correct as well.