Pen testers suggest what organisations can do to make their job more difficult.