Show any CEO a printout of their company's payroll or an audit, and chances are they'll recognize the need for improvements in security. For the test results to have maximum impact, the tester needs to put them in terms easily understood by the target organization's management. Many non-technical managers either don't care or won't understand the need for systems security until the consequences of an attack are spelled out in plain language. Penetration tests are ideal for testing detection and response capabilities. Given that most computer emergency response teams are woefully unprepared and inexperienced, the penetration test provides a great opportunity to gain experience in a consequence-free exercise.
Penetration tests are a great tool for determining the current security posture of an organization.
The results will provide direction on allocating limited resources. Despite its advantages, penetration testing has several limitations. A typical penetration exercise is not a comprehensive evaluation of security, since many security issues and configuration problems may not be identified. If the limited nature of penetration tests is not understood, the exercise can give an organization a false sense of security. For instance, if a host is not compromised during network attacks, the penetration testers will not be able to check its configuration for privilege-escalation vulnerabilities.