Phase 4 – penetration testing