A service for “ordinary people” would likely involve targeting services which are not operated by the customer (e.g. brute forcing gmail or fb creds). The test

A service for “ordinary people” would likely involve targeting services which are not operated by the customer (e.g. brute forcing gmail or fb creds). The tester would be taking on legal risk for performing any kind of account takeover. Consequently, I don’t see this as a viable service offering.