Is a thorough third-party penetration test ultimately the best way to determine whether our data store, which contains customer data and is made accessible to several Internet-facing Web apps, can’t be accessed improperly?