Reply to post:

"There are lots of CMSes and even ones that take security seriously and run their own pen-testing."

Please do list the free ones of which you are aware that are not Wordpress, Drupal or Joomla and which can reasonably described as "major".