Traditional security testing rarely delivers on expectations due to the limited amount of effort that the provider can dedicate to the project, the test merely validates that your organization can resist a few hours of attack but does not reflect the risk you want to measure.