Thanks for registering for Under the Hoodie: Lessons from a Season of Penetration Testing