Don't include social engineering in penetration tests (2017)
jacobian.org