The individuals performing the tests , which at various organizations were internal auditors , contractors , student interns , or central security staff , were encouraged to research and use hacking instructions and tools available on the Internet or from other sources in order to simulate attacks from real hackers .
All of the testing was done by an outside security auditing firm .