This is true, real world "pentesting" is about risk assessment, configuration testing, and vulnerability testing. It's not so much about exploitation (although it IS the fun part). Most of the time the exploitation is done in the webapp side or clientside type of tests. It really depends on the scope but we have very few clients who will let us exploit production machines, which sucks because after we clear the DMZ we know we'll find juicy systems =(

Thanks Kev, Jhaddix

These are the responses i was looking for really as i wanted to perform whichever course is likely to help me progress in the pen testing field.  As posted previously I would have liked to have done the GPEN as it goes through the pen testing methodology used but was only able to get on the GCIH as a facilitator which is still very good but doesn't cover report writing and stuff like determining what vulnerabilities are classed as "critical" "High" etc as you would need to understand for a pen test.  It does explain how to protect systems against attacks which is obviously very important to understand as a pen tester so that you can advise what needs to be put in place.