Story of a failed pentest
The problem I have with pen tests is that they're not systematic and rely on the cleverness and knowledged of the tester. Even if they identify an issue, it's often hard or impossible to ensure it doesn't regress, and if it's an inhouse or custom software they've never seen before they likely won't be of much help without a lot of effort.I think one step forward would be also approaching security the same way epidemiologist track down causes of diseases. In that they take patient data and trace back the factors that caused it, just instead of patients we're talking about security vulnerabilities and breaches. Having a corpus of causal diagrams that then we can develop software to analyze risk factors that we can then systematically test for.