Re: This study says what?
"I'm thinking the companies who would allow this study to take place on their systems likely don't think security first; skewing the results."
A minimal amount of research - if you could go as far as calling a quick Google and looking at their website research - shows that they're security consultants who do such scanning on clients' cloud use to look for this sort of thing. So companies who call them in are actually being security conscious* and the skew might be in the opposite direction to what you thought.
*Or maybe not if they're using someone else's computer.
Biting the hand that feeds IT
