What should we expect from the penetration testing process?