Most IT leaders rely on penetration testing as the sole method to determine whether their applications are secure enough to go into production. But penetration tests can’t be a primary source of assurance because they simply aren’t designed to verify all of the controls in an application. Penetration tests are simulations of real attacks performed by expert humans armed with hacking tools. We are many years away from having security tools that can even start to allow penetration testing to work on technologies that we use right now. The custom authentication and protocols used in both mobile and HTML5 WebSocket applications create all kinds of difficulties for testers.”]
Source: https://www.inforisktoday.com/blogs/beyond-penetration-tests-p-1174