> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. He didn't say that

> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it. > It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario. I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.