The one-two punch of compliance auditing and penetration testing