Penetration testing and who performs it