My colleague Denis has put together some cogent thoughts on what the state of the art in security testing actually involves: https://pulsesecurity.co.nz/articles/timeboxed-penetration-tests Expect further articles in this series.