Isabelle,

Nice points, especially how you tied third-party audits to both compliance and real improvement, not just a checkbox. I also like the “fix, then recheck” loop.
If you could track only one metric after an audit to prove security is getting better, which would you pick and why?