My reaction when someone from finance team says annual pentesting is enough

https://preview.redd.it/8i00ja4n325h1.jpg?width=777&format=pjpg&auto=webp&s=d342db5cdc56bb752327997951cc7d0c79a7e3ab

How security teams feel explaining to non-technical management why we should invest in automated pentesting tool and security before getting hacked