I used to do this same thing and never heard about pen testing firms being sued by their client. Most likely he was spinning a yarn. It is more likely that a

I used to do this same thing and never heard about pen testing firms being sued by their client. Most likely he was spinning a yarn. It is more likely that a security consulting firm will be sued if they report no issues and the bank is later compromised.