Yesterday I made a tweet stating that pen testing and pen testers are obsolete. Here's what I mean by that.
Originally, pen testing was a simulation of what real attackers would do. Then it became more about validating vuln scan/assessment results. Now its essentially about compliance check boxing. (PCI)
Vulnerability assessment pretty much no longer requires a skilled tester. There are now (and have been for a while) appliances and products which can schedule and automate vulnerability scans. At this point it is essentially a component of patch management. As vuln scanning has gone, so will pen testing go.
-->