ST1114

I am currently working on a research project and was told about a study that had two penetration tests on the same network and found that their individual findings only overlapped by roughly 25%--AKA they only find 25% of the same vulnerabilities. I was told that this was a study done by Microsoft but have searched high and low and been unable to find it. I was hoping someone else may have some information or know where to find this report or any reports with similar findings.