Is that pen-test worth the money? Hard to tell sometimes isn't it? In this paper Risk Factory explains how to calculate the value of a security penetration. Mandatory reading for anyone struggling with justifying a testing budget.