My project's client, a major local bank, mandates pen testing before we go live with the product that we're building. Due to time and resourcing constraints, a

My project's client, a major local bank, mandates pen testing before we go live with the product that we're building. Due to time and resourcing constraints, and a fixed launch date (don't ask), we had to significantly reduce scope. We are currently launching with probably 30% of the original scope. Once live we'll iterativley add features and grow our product to bring it back to the original vision. Will we have to do pen testing again in the future? Nope. Even though a lot of our planned post launch features involve integrations with 3rd parties and the exchange of sensitive personal data. Pen testing is 100% a box ticking exercise in my opinion. And most of the shops that offer this service are set up to provide the service such that large corporates to appease legal. I really don't like pen testing as a practice and seriously dislike when it's a go live impediment.