I can't tell you for sure that this is truth or fiction, but I've worked in information security for seven years (three as a consultant), and the story is 100%

I can't tell you for sure that this is truth or fiction, but I've worked in information security for seven years (three as a consultant), and the story is 100% believable. The writing style is also consistent with the way about half of the pen testers I know write when they're not writing a formal report. I specialize in the remote version of the kind of test the author describes. I'd be happy to do it in-person too, but usually the clients were less interested in that.