How do you quickly build trust with an internal IT team that may be defensive about an external security audit?