Security teams spent years treating penetration testing like a scheduled event. A company hired testers, waited for the report, assigned fixes, and repeated the process the following year. That model ...