I think the arguments <i>against</i> penetration testing are interesting.<p>As a software test engineer, we do external audits like this, but I wonder:  Documented or &quot;known&quot; vulnerabilities are not worth testing until there are systems in place that expect to cover them.<p>It seems that all vulnerabilities that are not intentionally addressed should be considered dangerous.  If they are penetration tested but vulnerability is unknown, the best you could hope for is &quot;Not vulnerable for unknown reasons&quot; which is just as bad as vulnerable in my perspective.<p>With some admitted trepidation, I assert that all software should be tested this way, with expected behavior being a primary dependency.<p>Edit: hiring outside penetration testers is still totally valid and desirable, since development and testing are two totally different domains. I&#x27;m only pondering methodology.