I would be pretty scared to not have control over who is doing the PEN testing. In reality, you are providing free license. With a contract + MOU you have...