The individuals performing the tests, which at various organizations were internal auditors, contractors, student interns, or central security staff, were encouraged to research and use hacking instructions and tools available on the Internet or from other sources in order to simulate attacks from real hackers.
All of the testing was done by an outside security auditing firm.