Attacker groups that target web applications do not use the same tactics that your penetration testing team does. This leaves a gap between vulnerabilities that your team finds and vulnerabilities that attackers are actively discovering and exploiting. This talk will use actionable data about real attacker groups to develop tools and methodologies to aid your penetration testing team.