It's a moot point for a security vendor to establish its competence without establishing its trustworthiness.