The Good, the Bad, and the Ugly of Penetration Testing