In a rapidly shifting attack landscape against the backdrop of a hackers’ black market worth billions, if you wait to pentest — you lose.