While "useful service" may be generous wording, in my own experience, when given the option between "pentesting" and "ransom+patching", most corporations would prefer the third, cheaper option: do nothing.

But what would be the point of pentesting if there were no hackers?