Why in-house pen testing is not sufficient