Actually, no. A first sign of semi mature security program is risk management, including issues that are known, but not yet addressed.

You don't have to be 100%. But these guys really didn't try at all.