Remediation-driven penetration testing programme — closing the security gap through governance framework and tracked remediation.