The engagement period that it takes to successfully go through data and
understand it may require more resources
than a company is ready and
willing to allocate.
Pen testing is not a conclusive security audit. Combing through the system
for vulnerabilities does not guarantee that one will find all potential areas of
interest to hackers. The methodology used also determines the range of
vulnerabilities that the tester can discover and help the company secure. Pen
testing can also be a distraction to normal operations as it involves probing
all security systems.
