> How do you know the penetration testers you hired are not black hat hackers?

Is the implication that all pentesters are black hats until axiomatically proven otherwise? High bar.