Limitations of automated pen-testing