I personally agree NetPen is the least demanding. Not because there aren't incredible netpen testers nor that it can be challenging, but generally you have a lo

I personally agree NetPen is the least demanding. Not because there aren't incredible netpen testers nor that it can be challenging, but generally you have a lot of attack vectors across a very complex piece of infrastructure, and you just need to find the weakest link to win. Compare that to say, cryptography or code review, which typically require fairly deep specific knowledge and a lot of intense focus, as opposed to broader knowledge and a willingness to try a lot of different things. Most findings in netpen reports I see are basically that something wasn't configured correctly, or that one of the 10k employees had a weak password, or someone got phished. I often chuckle but rarely am surprised or learn too many new things.