First is that developers are not pentesters and usually shouldn’t be. mostly because they look as the problem as an problem with a single application and not how all those issues fit together as its related to your network security posture and for protection of your critical assets/data/or IP.

Second, you’ve described perfectly what should go on during a vulnerability assessment and application (source) review and not a pentest.

we need to get away from “pentests” that attempt to find every possible vulnerability, those are vulnerability assessments or if you want to justify your existence vulnerability assessments with exploitation or vulnerability assessment with source code audit and not pentests.

Its time for a pentest when you’ve done all the things you mentioned in your posts and you think your app is good to go & no one can break it or into it. Or more importantly you think you can catch the attacker once he’s in your network and one 0day doesnt ruin your whole day.

Your find every vulnerability pentest can be / should be/ and rapidly is being replaced by a monkey with a scanner or an appliance in a rack.

see chris nickerson for the rest of the rant…