I believe a LOT of security testing will evolve to QA and software testing. There a LOT of issues will be found. Instead on micro-focuses (in the past), the CD approach can test the whole system, which is a huge leap forward.<p>Pen-tests should be good reality checks to ensure the system is working, and that it is sufficient to withstand current attacks.<p>Sometimes companies are very smug and need the reality check. Boards are starting to request them to ensure the confidence is warranted.<p>I&#x27;ve also seen pen tests used as a tool to GET funding. Fail one big time due to known vulnerabilities just to show how messed up things really are...then get a budget to fix them.