Using penetration testing to enhance your company's security

Based on the fundamental principle that prevention is better than cure, penetration testing (pen-testing) is essentially an information assurance activity to determine if information is appropriately secured. Conducted by penetration testers, sometimes referred to as ‘white hats’ or ethical hackers, these tests use the same tools and techniques as the bad guys (‘black hat hackers’), but do so in a controlled manner with the express permission of the target organization.
Vulnerability scans versus pen-testing
A common area of confusion is the relationship between vulnerability scanning (automated) and pen-testing (expert-driven manual testing). Both involve a proactive and concerted attempt to identify vulnerabilities that could expose the organization to a potential malevolent attack.
Vulnerability scanners are great at identifying ‘low-hanging’ vulnerabilities, such as common configuration mistakes or unpatched systems that offer an easy target for attackers. What they are unable to determine is the context or nature of the asset or data at risk. They are also less able than humans to identify unknown-unknowns (things not already on the risk register, or which haven't been theorized by the organization as potential security issues). Good pen-testing teams, however, do this very well.
For instance, pen-testers can give countless examples of engagements where an environment was previously scanned only for vulnerabilities. When the same environment is subjected to a pen-test, the pen-testers manage to compromise a number of systems, gain unauthorized domain administrator or root access to systems, and ultimately gain unauthorized access to sensitive data. One final distinction is that vulnerability scans are unable to process certain types of security issues, such as subtle business logic flaws that