“To me, the waterfall methodology lends itself most to the traditional approach to pen testing, which, most organizations will test their key apps, once a year or so.”

Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 1.