PP004: Exploiting Vulnerabilities, Not Customers: How to Pick Good Pen Testers