Compliance, as opposed to security, driven requirements for annual penetration testing coupled with a desire to have tests performed as inexpensively as possible, have created an industry-wide trend towards the commoditisation of penetration testing services. This issue has become even more pronounced recently with the introduction of PCI DSS 3.0 which mandates increased levels of penetration testing compared to version 2.0. This results in increased client costs, and to mitigate these increased costs, clients often attempt to reduce the duration and scope of testing to keep these costs down. The impact is a general reduction in the quality of penetration tests, with the output of many penetration tests being nothing more than re-branded vulnerability scan reports. The speaker provides a unique insight from the tester’s point of view, and compares and contrasts the attitude to penetration testing when mandated by compliance versus when pro-actively introduced to assess risk. The talk will look at the why cheaper is never better, and the inherent dangers that lie in the commoditisation approach. A discussion of what a good penetration test really entails, with real-life examples of where so-called ‘low’ severity scan findings have resulted in complete compromise of systems when manually examined will also be presented. Users will gain an understanding of the various counter-measures to this trend of commoditisation. Conor will then open up to the floor to gain an understanding of what individuals at various levels of the industry can do to reverse the trend.