Someone asked me a question next to water cooler:
It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests?
I was speechless, could not provide any answer.
It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.
But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.
The purposes are:
Every complex system is like that.
Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why we still use them? If anti-aircraft defense does not shot all bombers, why we bother? Because results with using more layers of defense are better than using only a single layer of defense.