Cybersecurity Pen-Tests: Time to Get Smart About Testing?