It is difficult to see the vulnerability in our own defensive plans. External testing of security can be a cost-effective measure that complements internal and external audits. The difference between an audit and the test is that the former focuses on policy whereas the latter looks at results. Many of their clients need more than one pass to achieve TruSecure certification. CURE, a test procedure based on BS7799.
Many consultancies offer systematic evaluation of information security preparedness.
When choosing external vulnerability analysts, companies should look carefully at the backgrounds of the employees who will be checking security. I do not recommend employing firms having active or recently active criminal hackers on staff. In summary, managers must recognize that security requirements change all the time. Keeping up to date is not a luxury, it's a necessity. Getting buy-in from every part of the organization is as key to success in security as it is in quality.