Pentesting in the spotlight – a view

This piece critiques narrow, attack-focused penetration testing by reflecting on Haroon Meer’s talk and argues that pen testing is only one phase within broader security assessment. It highlights how 0-day capabilities distort outcomes and proposes using '0-day cards' to emulate such advantages, while recommending enterprise-wide threat modeling to enumerate, prioritize, and test risks systematically as part of an iterative, business-aligned risk management process.