True, but managers also usually fail to account for the time and cost of remediation after a pentest.
Had the city engaged in the pentest, would there have been an appetite to spend 10-20x that amount on remediation?
Had the city engaged in the pentest, would there have been an appetite to spend 10-20x that amount on remediation?