Is Penetration Testing Worth it?
http://www.schneier.com/blog/archives/2007/05/is_penetration.html