Penetration testing is a well understood discipline of information security testing. Over the last decade scores of books have been written on the topic, many of which take you through the subject with step by step instructions for conducting penetration tests. So the question we often get asked as consultants is why should we hire an external party rather than conduct the testing in-house? The answer may depend on the skill set of your staff, but there are other factors to consider as well.