what do you mean no movement?

isnt pentesting supposed to generate tickets to fix vulnerabilities?