> Why do security people feel compelled to pen test sites without a contract or formal engagement? They didn't in this case. Though, maybe you could argue that

> Why do security people feel compelled to pen test sites without a contract or formal engagement? They didn't in this case. Though, maybe you could argue that the engagement wasn't formal enough. They found the initial hint of the bug from normal use, and requested permission before doing the actual pen test. Regarding the analogy, this isn't some random house they wanted to test. It's an essential service they used and depended on. Perhaps your analogy can be improved by them being an apartment building resident interested in the security issues of the building as a whole, since it affects the security of their own apartment. Even then, it doesn't seem like a perfect analogy that accurately reflects the situation. In the analogy, you could argue that they should change buildings if they're concerned, but banking options seem way more limited in comparison.