If a site states it has contracted such and such a security company to check on and maintain its security your client can at least claim to have done everything practical if security is breached. There is much you can do to secure a site even without specialist help. Assuming the site has been configured properly to begin with ensure security advisories are read, security patches are applied and security related upgrades carried out. Refuse to trust security through obfuscation. If a software vendor won't discuss the security issues you raise don't use it.
Security works best if it's been peer reviewed.
Concealing problems benefits crackers, not clients. Process log files. Logs are your greatest security aid. OK, they're large, but processing data is exactly what you bought computers to do. Once you know what you're looking for it's relatively easy to set up scripts to process logs and email an administrator if anything is amiss.