Many UNIX servers come shipped, by default, with lots of unneeded services enabled, and often more services are added on top with little or no thought to strong security measures. For many sites, this methodology works just fine - until one day, there is a major security breach. System security is very much like physical security. You can secure a wood door with a deadbolt, but it is still susceptible to a door ram or a Milwaukee Sawz-All. You can put your valuables in a bank vault, but someone with the right tools and sufficient time will still manage to break in.
Physical security is all about deterrence.
The goal is to put up enough defenses that breaking in is really not worth the effort. System security is the same way. Unfortunately, most systems that we see do not put up many layers of defense. We then audit your UNIX server systems to provide additional areas for improvement. We can also monitor various reporting mechanisms for the latest security exploits discovered in your applications, so that you have an opportunity to update your services before crackers get around to exploiting the hole.