I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense,

I am too, but was curious what degree of responsibility is expected of them by the law. i.e., is deferring to whatever sales/legal drafted enough of a defense, or something else. I work in professional services (although not pentesting), so I curious about what would happen to me if I was in a similar position.