> I really don't like pen testing as a practice could you elaborate on this a bit? what's wrong with it? to me it seems the only logical thing to spend externa

> I really don't like pen testing as a practice could you elaborate on this a bit? what's wrong with it? to me it seems the only logical thing to spend external security budget on. (or internal red team if the company is so bit it can afford it.)