A company's website is vulnerable to several attack vectors. The company has hired a red team to identify these vulnerabilities and exploit them to gain access to the company's systems.

What is the best way to mitigate the risk of these attacks?

Attack surface reduction

Security control testing

Penetration testing and adversary emulation

Bug bounty