How will they distinguish between hacking and penetration testing?