Penetration Testing: How to Test What Matters Most