It’s a tedious task of finding out potential loopholes in your software system by simulating an attack from outside. Since the test takes place in the perspective of a potential hacker even the minute vulnerability can be fished out to make the website/app hack proof.