Agreed. Pretty sure you are supposed to ask for permission before pentesting someone. Hopefully they, being a security company, know that.