[EToS]

Could be an interesting marketing approach for a Security/Pen Test SaaS.. Heres a vulnerability, pay for our service and we'll provide a full report.

[senko]

I get spam for that all the time - both for "pen test" and for "seo test".

Basically someone fires up a tool that checks a few things mentioned in a best practices document somewhere, scans as much domains as possible, and then sends out emails with the (subset of) the results.

Invariably, the results are false positives but hey, if you don't know that, they might get a new client. They'll file the (automatically generated) report and presto, easy money and a chance to upsell a retainer.