100% correct. What I meant though was that the good security companies get their clients to sign a contract that precludes the security company, or it's employe

100% correct. What I meant though was that the good security companies get their clients to sign a contract that precludes the security company, or it's employees, from being sued as long as their penetration falls within the parameters specified by the client (the Rules of Engagement if you will). That is the protection I would want.