Once complete we give all clients a recommended path for improvements across the entire site,  not only for security but also for performance.  Sometimes recommending replacement plugins or themes for ones we see as a high risk,  either because of abandonment from the original developers or known and repeat security problems.