When I followed up, I found that an employee had been detected accessing salary records - caught because he tried to change one. It turned out he should not have had access to any of those records and could have read all the other employee information without being detected. When we dug deeper, we found more and more, until finally, we were able to effectively demonstrate the ability to alter arbitrary records and gain systems administration privileges undetected starting from the Internet. There are a few tell tale signs of real experts, and real experts are the best way to find other experts. But be careful and cross-check wherever possible.
Real experts tend to write articles for legitimate publications.
That is not to say that all the authors are good security consultants, but most of them know something about the field. Real experts go to public meetings and conferences to hear what other people have to say and give presentations of their own. If someone has given talks for several years in a row at the same conference, chances are the audience found value in what they had to say. Real experts don't claim to be experts in every aspect of the information protection field. They may assert that they are knowledgeable across the board, but if they claim to know all about the details of security for every operating system and every platform, chances are very good that they are not really experts in any of them.