[mothered]

It makes you think they're just waiting for something to go wrong before they do anything about it.

It's certainly the case and It's appalling to say the least. You can see In the above screenshots that I've got full raid on their systems and If I was someone who's maliciously-minded, well, I won't go Into detail of the consequences.

A lot of organizations do not even bother to check their logs etc. For testing purposes, I've planted backdoors to gain later access and upon doing so 6 months later, It (backdoor) was still there.

Out of curiosity, what did you do next? Do you notify the company when you find things like that?

I used to notify the organization outlining their flaws, and recommend corrective measures to help fend off future attacks.

However, (without going Into specifics) most took It as unethical access to critical data and some even threatened to file a lawsuit. As such, I've ceased communication. It's their loss, not mine.