While sanctions for violating an NDA during an assessment aren't usually defined explicitly in the contract, most security firms would never divulge methods and

While sanctions for violating an NDA during an assessment aren't usually defined explicitly in the contract, most security firms would never divulge methods and results even in a sanitized account like this. Security firms rely upon their reputation since they're get a good look under the kimono. That leads to either the bank approving of this article or Security Compass having loose lips. I can't imagine a bank signing off on releasing this info, as it paints bank security in a bad light. I expect that somewhere, someone is contacting their internal IT staff to find the SOW for this pentest, and then contacting their legal dept.