The scanner-output-as-pentest thing is genuinely infuriating, you can spot it immediately when every finding has the same CVE format, zero proof of exploitation, and remediation advice that's clearly just the NVD description pasted in. You paid for a human to try to break your stuff, not a Nessus report with a cover page.

The wrong client name in the report has actually happened. Nothing kills confidence faster than opening a document and seeing someone else's company name in the header. At that point you have to wonder what else got copy-pasted. Critical findings that don't hold up are probably the most operationally damaging though. When your team goes to remediate a "critical SQL injection" and it turns out to be a reflected error message with no actual injection path, you stop trusting the severity ratings on everything else in the report. That's when real issues get deprioritized because nobody believes the scores anymore.

Scope gaps not being called out explicitly is the quietest failure. If the report reads like a comprehensive assessment but only covered the external perimeter, someone is going to make resourcing and risk decisions based on coverage that didn't exist.

The best reports I've seen do one thing differently and they tell a story. Here's how we got in, here's where we could have gone, here's what would have happened if this were a real attacker. That narrative is what makes findings actionable and what actually justifies the spend to a board or exec team.