I'm guessing the ransomware gangs would be giving better payments than regular companies asking for pen-testing.
But with this, comes other concerns:
- Will the pen-tester be enticed to use the "authorised hacking" as an opportunity to install a backdoor of their own or do they maintain strict borders between both jobs?
- I'm thinking, not so much, as, if they're already doing something illegal, they might as well just go the extra mile.
- At the same time, pen-testers working for one company might also be used for industrial espionage efforts, by competitors