Charney: Penetration testing puts your finger in the dam hole