Having occasionally worked with pen-tests, I think perhaps a different lesson is in order. If you can find it in a pen test, so can your adversaries. You have n

Having occasionally worked with pen-tests, I think perhaps a different lesson is in order. If you can find it in a pen test, so can your adversaries. You have no way of knowing if they've done so already. The best way forward is to address the issues as quickly as is reasonably possible. Secrecy protects the pen-test findings document, but not your vulnerability. The map should never be confused for the territory.