When the SOC 2 auditor tells me they also do pen testing.