Historical question — why did we as an industry decide that penetration tests needed to be outsourced, but that we didn't need outsourced application security tests or code reviews in the same way?