Just when you think your application is free of defects, you find security vulnerabilities lurking beneath the surface. Penetration testing can help you get them before they get you. Ryan English discusses vulnerabilities and offers five steps to organizations looking to start a Web application security initiative.