Adapted from my response on MM:
In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration as the PHP code. The CiviCRM codebase has benefitted from several third party audits for security which have resulted in security releases but, and this is important. It's only as secure as your server is configured to be.
We could have the best, most secure PHP code in the world - but a minor misconfiguration on your hosting risks negating it entirely.
The security of CiviCRM, like any other application also relies on regular updates to maintain security - for example any version less than 5.35.1 or the latest ESR (5.33.3?) has known security holes unless manually patched (or updated to one of those supported versions)
Some organisations choose to maintain additional security by separating CiviCRM onto a separate host/server from their website or having CiviCRM behind their firewall in their LAN.
There is some information on our security processes and releases here: https://civicrm.org/security