A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits t

Asking for more money is not a consequence of sharing prior audit reports; it is unrelated to the ethical and legal risk created.

Audit and penetration test reports contain detailed findings about vulnerabilities, misconfigurations, and weaknesses specific to the client that commissioned the work. Presenting these reports to a third party - even to demonstrate competence - discloses confidential security information about those prior clients without their consent, potentially enabling exploitation of the exposed vulnerabilities.

The bidding company preferring a specific test format is a minor and unlikely outcome compared to the serious breach of client confidentiality that occurs.

Being hired is not the likely outcome; the more probable result is legal liability and reputational damage from violating client confidentiality agreements.