Ask your cyber vendor where its penetration test originates – the answer may surprise