This episode delves into the world of the surprise penetration test. 
Is it a good approach or is it better to let everyone know that you are about to conduct a penetration test? i.e. if no-one knows about it, then the "attack" will be handled as it should. That is unexpected and using all the people, processes and technology that one would expect when an attack occurs...a good test of the organization's ability to respond and recover.

Does the surprise attack pose problems though? What can go wrong?
Listen to this episode where someone's decision to conduct a surprise penetration test had deep consequences.