> Just doing your job as an engineer and looking for bugs is not a pen test A pen test’s goal is to find security bugs by posing as an attacker. There is no re

> Just doing your job as an engineer and looking for bugs is not a pen test A pen test’s goal is to find security bugs by posing as an attacker. There is no requirement that it is systemic, formally documented, performed by a “security expert,” or that it is done by any external party. Those are all desirable _properties_ of a pen test that may be required for various certifications, but an engineer can absolutely conduct a quick and informal pen test at any time.