[maxxxxx]

That's exactly the same logic my director applied to pentesting. If you don't test no vulnerabilities will be discovered.