Show, Don't Tell - Proving Your System Security

In reading The Cuckoo's Egg, by Clifford Stoll, I was surprised that Stoll’s hacker gained most of his success by exploiting simple oversights in system administration.  This hacker would check generic accounts like username: guest, password: guest. In about one of twenty attempts he would succeed. Interestingly, most current cyber attacks also take advantage of simple oversights. The foremost of these involve SQL injection, a well-known and easily preventable attack. Amazingly SQL injection is the culprit for the majority of data theft and loss on the web. The outside world tends to view strong cyber security as being reliant on bigger and better programs, when in reality security stems from informed, vigilant system administrators. To me, it seems that any secure company needs a division devoted to solely to penetration testing. To those who claim their system is secure, I say prove it! What kind of hackers have you thwarted? How many companies have tested your security? Software and architecture mean nothing, only once a system has held up against thorough penetration testing should a system be labeled secure.