What we learned from 100 Pen Tests, 75 Organizations, 450 Attack Vectors [pdf]
praetorian.com