First, individual users quite often control the security of their own computers, without having much technical experience or security education. This means that they often do things that inadvertantly compromise a system or site's security. Second, the impact of a client's security on a larger organization's overall security is often overlooked and even more frequently flatly ignored. It's a serious subject, few have covered it, and I could write another paper on this subject alone, but I've compiled a few suggestions to attempt to cover the basics of this thorny subject. Needless to say, we have a long way to go.
Consistency is the key to effective security.
Most organizations don't have the resources or expertise to monitor their own critical systems effectively. This individual or organization would have a significant amount of power over the sites it covered, which, of course, would require a great deal of resources and trust from all involved. Needless to say, they must have impeccable security themselves. The danger would be diminished if they didn't have an account on your systems, but the effectiveness would also be lessened. Unfortunately, unlike in the financial markets, there are no organizations of note that monitor sites or give any assurance that they are secure.