security is not just about penetration testing