Hacking involves creativity and thinking 'out-of-the-box', then vulnerability testing and security audits will not ensure the security proofing of an organization. To ensure that organisations have adequately protected their information assets, they must adopt the approach of 'defence in depth'. In other words, they must penetrate their networks and assess the security posture for vulnerabilities and exposure.