Why a Human Element Matters in Penetration Testing