I am currently enrolled in Offensive Security's "Penetration Testing with Kali" course, which is aimed at newcomers to penetration testing. The course is great, with many examples/exercises, and a great virtual lab environment which allows me to connect via VPN and practice everything we've been learning.
One thing which I have noticed is that many of the vulnerabities we've been studying/practicing have been on older e.g. Windows XP/2003 systems, older Linux versions, or have been relying on misconfigured systems (which, if configured correctly, would be much more secure) or protocols which are known to have serious flaws in them.
I'm well aware that newer versions of these systems have vulnerabilities of their own. I am also guessing that many of the older systems still persist in usage within organizations anyway. However the weight of the study material which is placed on older systems makes me wonder if in the future, penetration testing will necessarily either become less useful or need to shift in its methods as developers become more security conscious in authoring their protocols/apps/OSs, and as their tools become more advanced. E.g., many higher-level languages manage memory for developers, making buffer-overflows much less likely, even for careless developers. Also, it is my perception (though I could very much be wrong, I'm no expert) that modern operating systems are significantly more secure than their predecessors.
I know that ANY system will have SOME flaws somewhere, however it seems that penetration testing as a professional level involves by definition some degree of standardized scanning/exploitation of known vulnerabilities. My question then is, is the surface area which professional penetration testers shrinking, as security-awareness increases among developers of apps/protocols/OSs, and as the built-in security of their tools improve?
I'm not implying that I think penetration testing would ever "go away", but e.g. it might start to rely more on social engineering than actualy technical vulnerabilities in the networks or software.