As someone who’s worked in physical security and monitoring, this is the part that worries me most: once “testing” systems start crossing boundaries on their own, the line between audit and attack gets very thin.

Curious whether these companies were fully aware their infrastructure was being used as a live playground.