If we can not catch all of security bugs, why do we still test?

Question

Someone asked me a question next to water cooler:

It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests?

I was speechless, could not provide any answer.

Answer 1

It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.

But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.

The purposes are:

1. Identify risks and evaluate the effectiveness of existing security defenses. / Evaluate current software quality
2. Security testing/software testing shows our due diligence has been performed in protecting digital assets / improving software quality
3. In event of legal actions, we have proof that we have taken steps to protect sensitive information / improving software quality

Answer 2

Every complex system is like that.

https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why we still use them? If anti-aircraft defense does not shot all bombers, why we bother? Because results with using more layers of defense are better than using only a single layer of defense.