Doing so would also be counterproductive to the goal of minimizing the network security exposure of Cisco's clients. Although potential clients may object to this arrangement, Cisco Secure CS also recognizes that those clients would want the same level of confidentiality. Upon specific request, Cisco Secure Consulting can attempt to arrange a one-time reference for a customer, based upon availability and willingness of the reference. In these situations, it is requested that the customer requesting the reference agree to become such a reference in the future should they purchase and be satisfied with the service. Cisco Secure Consulting also uses public analysis of its services in lieu of references, including write-ups in Fortune, Network Computing, and Information Week.
SPAs provide an analysis of the state of the network's security for that particular point in time.
Security certification can be misleading and, in many cases, can provide a false sense of security. Because the network is constantly changing, it is always susceptible to developing new or different vulnerabilities. The network, as well as the vulnerability environment in which it exists, is constantly changing. As such, the network faces continuous exposure to new vulnerabilities over time, creating potential gaps in the certification confidence. A more appropriate demonstration of security awareness and diligence is the combination of the SPA deliverable and recommendations coupled with the record of improvements made as a result of the assessment.