How to get the most from penetration testing