I remember once I had to implement recaptcha in a site, and it was one of these "uninvasive transparent recaptcha" that just analyzed your behavior without making you select any pictures
then the infosec audit team came and complained that "they couldn't see any recaptcha"
and my only answer could have only been "well, I did a good job then, thanks"