the quiet part is that the whole idea of CNAs turned 100% of infosec scoring systems into marketing vehicles, and now there are knife fights in the parking lot about who is right and who is faking it for clout and at this point the water is so muddy none of them really actually matter anymore
making the 'my nessus scan is my pentest' crowd completely and utterly useless (which i'll argue is a very good thing)