Sounds like you're doing security assessments for compliance reasons, but I see no mention of compensating controls, acceptable risks, remediation plans in action, etc.
This whole question is really weird to me because from the information you've provided in your question, it seems like neither side of the business relationship -- either you or the client telling you to cover things up -- is qualified to perform compliance assessments. Not trying to be harsh, but there's simply way too many red flags. I'll explain why below.
For some things, the client will not, cannot, and should not be forced to fix in order to get a "Clean Report," but let's [Mass Dispel] some things first.
Security Assessments
A security assessor's job is to find vulnerabilities, and help explain away vulnerabilities that are not exploitable. Something may be vulnerable, but there could be multiple reasons why it isn't exploitable.
It will then be your job to examine the evidence and determine whether or not the evidence is correct, and then exclude those irrelevant items from the report. In the case of PCI compliance, evidence of this will need to be provided to a third-party Qualified Security Assessor.
If they're hiring you to do the explaining, you'll need to dig deep on each vulnerability you find and attempt to assess whether or not that vulnerability can be exploited. Work with the engineers (sysadmins, developers, network engineers) to get the information you need.
It could be something simple such as nmap/Nessus/etc. returning the wrong version, not realizing that a backported version exists, or something to do with multiple compensating controls for common TLS "misconfigurations."
You can check for the exact version with dpkg -l | grep 'package' for example, then determine if a backported security patch was applied. This problem is really common with many approved scanning vendors.
These are businesses who can't stop what they're doing to fix every little thing that isn't exploitable. It's not a sustainable security model. Should they still be made aware? Absolutely. But they need to prioritize fixes and manage risk.
Clean Reports vs. Fraud
Correct me if I'm wrong, but it sounds like they're looking for a clean report with no remediation. Something's really fishy here. This doesn't make sense.
Any reputable company, especially those involved in required compliance audits, be they quarterly or yearly, will fix all of the vulnerabilities which prevent a passing score for their compliance report. In many cases, they are able to circumvent fixing these vulnerabilities if they can provide documentation for compensating controls, acceptable risks, remediation plan in progress, etc., and you will be required to accept these circumventions if their evidence is correct, but you will need to examine it yourself.
If they attempt to pass off a clean report that is not really clean, then it's fraud - especially if they're pushing these lies to their clients. That's fraud in the highest order, and you do not want to be complicit in this. There will be severe penalties for both you and your client.
Fraudulent Activities
My responses in this section will be made with the assumption that no compensating controls, acceptable risks, remediation plans in action, etc. exist, and they're trying to cover up vulnerabilities.
They are (rightfully scared) of what I will find. Some even tell me "don't go so deep this time, ok?"
Assuming what you're saying is true and not taken out of context, then I'm pretty sure that's illegal -- unless you're going out of scope. The company should provide you a scope, and you must stay within whatever is determined to be in scope for the audit. If you intentionally go outside of your defined scope, I'd be surprised if they continue to hire your company to perform assessments as that's a betrayal of trust.
The other solution I tried is restricting scope. If I only test a small part of the stack, the client could get what they are looking for: a "clean report". But it's rare that they agree to that. They usually want everything tested.
I'm having trouble with this. Almost every single client will provide a scope, especially those going through compliance audits. Not everything is going to be in scope for them. If you want to go out of scope because you think you found something dangerous, you need to ask permission and get it in writing.
I'm also worried that this will backfire because inevitably someone else will re-assess what I did and find massive holes. They they will conclude that I have no idea what I'm doing because I missed such obvious flaws. Reputation is everything in this industry, so this is a big risk.
If you're within scope, then... do you want to be complicit in fraud? You're worried you'll lose clients if people are asking you not to dig too deep, but think about what will happen when a qualified auditor shows up and discovers your company is complicit in fraud.
This is an extreme ethical violation. If you have an (ISC)² certification, then prepare for revocation if anyone finds out. This can also amount to a federal crime if you're in the United States, or anywhere else where fraud is illegal.
Believe me, as someone who has dealt with multiple penetration testing and security assessment firms, if you hold back on glaring flaws like this, many of us will no longer do business with you. If you have a reputation for doing this, it will spread quickly. I've seen consultation firms dropped for not finding very basic things that we already knew about.
Clean report with Remediation
However, it's not uncommon for companies to provide a clean report after they fix your proven vulnerabilities. There should be no need to provide penetration test and security assessment reports that contain vulnerabilities, but only the report after the company remediates them.
If you find more vulnerabilities afterwards (provided they're paying you to do so), that's actually great! Any reputable company will be glad to fix these problems (or have you or themselves explain compensating controls, acceptable risks, remediation plan in progress, etc.) so they can pass their audit.
If they're hiring you too late in their compliance audit process and are worried it won't be completed fast enough, then that's on them and not you -- unless you're too slow at getting your job done within a reasonable time frame.
Where's the remediation coming into play here?
Bringing Balance to the Force
How to maintain balance between integrity and client satisfaction in vulnerability assessments
There is no balance in the case of fraud or other crimes.
Do your job and do it right. Don't violate anyone's trust and do not commit fraud. Clients who ask you to commit crimes are not the type of clients you're looking for, or they shouldn't be.
TLDR
Get some more experience with assessment and compliance auditing. Manage risk, but don't commit fraud.
