How to Choose a Pentester for a Realistic Security Assessment and Action Plan