For sure, I wasn't disagreeing. I meant have someone look at your architecture and make sure best practices are followed and insane designs don't exist before y

For sure, I wasn't disagreeing. I meant have someone look at your architecture and make sure best practices are followed and insane designs don't exist before you pay for a pentester . pentest results can be used to adjust architecture but a pentester will show you one or a few ways they acheived the objective, they won't do a hollistic review of architecture,procedures,practices,etc...