Typically, penetration testing is done by third party private organizations that are white-listed by CSE, so that we know we're working with the right people and not the wrong people.
Overall, our spending on security on an annual basis is around $5 million.