While penetration testing provides valuable insight in helping to identify bugs in code, security assessments such as threat modelling are more effective at uncovering design flaws.