A good penetration tester will bring lots of extras to the table, the
big one I think being manual testing, which can confirm whether scan
results are indeed real or false positives and also pick up issues
that scanners can't such as business logic flaws.

External auditors are also able to help adv...

[ more ]