Security assessments haven’t changed for several decades, bad guys however have, and the gap between the reality of attackers’ activities and assessments is growing. We’ll discuss some ways to make these better leading to assessments actually answering questions for the target organisation and helping you to lower risk.