The vast majority of attackers are opportunist criminals looking for easy targets. If defenses are sufficiently fortified, finding a way through will be so difficult and time consuming that all but the most elite nation-state level threat actors will give up.Penetration testing is one of the most effective methods for achieving this level of security. Despite its value, we find that penetration testing is poorly understood outside of the security industry. The issues discovered through pen testing will often go beyond simple software updates and may require changes to operational processes and staff training.
Source: https://www.helpnetsecurity.com/2021/01/12/knowledge-around-pen-testing/