Question

Do you consider penetration testing worth the risks? Why or why not?

Answer 1

No, I don't Consider Penetration testing worth the risk because if you undergo regular penetration tests and remediate the issues you’re safe. You’re not. This is the wrong way to approach security and risk management for a few reasons:

1. If you put any hacker on your network for long enough they will find a way in. The real question is how you manage data loss, intrusion detection, and security as a whole.
2. If you aren’t doing the basics you will continually be at risk. If that’s the case you probably shouldn’t waste time and money on penetration tests. It’s safe to assume you are vulnerable.
3. Strong penetration testing against production systems could be an attack against yourself. It may not be worth the impact to your own systems.
4. If they’re not done right, they can create a lot of damage.
   Tests that are not done properly can crash servers, expose sensitive data, corrupt crucial production data, or cause a host of other adverse effects associated with mimicking a criminal hack.
5. If you don’t employ realistic test conditions, the results will be misleading  

Due to the above reasons Mentioned I don't consider Penetration Testing worth the risk.