“One of them, which we talked about a little bit, but I want to go into a nuance of it, is that identifying a vulnerability is not the same as assessing the risk that it presents.”

Transcript evidence from Caroline Wong — The state of Penetration Testing.