“Security leaders get hung up on this notion that a pen test has to be the classic two by two: give me two people for two weeks, and we’ll call it done. And that’s good. But what I’ve learned by working with Bishop Fox is that I can rotate the pen testers in over three to four months at a time and, in the first two days, they would find all the fluffy, obvious stuff. In about two months, they would say, ‘Oh, that looks interesting.’ Then in about three months, they’d say, ‘look what I did.’ It was really impressive, but it takes a long time to get there. It helps me understand how long it could take a motivated adversary with that same skill set to get to that point.”