The way most agencies work, the vulnerabilities would be considered classified information. So, the testers would not have access to classified information pri

The way most agencies work, the vulnerabilities would be considered classified information. So, the testers would not have access to classified information prior to the evaluation, but what they find during the evaluation would become classified.