Why Pen Testing Is Central to State's App Security