Once complete we give all clients a recommended path for improvements across the entire site, not only for security but also for performance. Sometimes recommending replacement plugins or themes for ones we see as a high risk, either because of abandonment from the original developers or known and repeat security problems.