Aligning automated penetration testing and risk management