anchor: The individuals performing the tests, which at various organizations were internal auditors, contractors, student interns, or central security staff, were encouraged to research and use hacking instructions and tools available on the Internet or from other sources in order to simulate attacks from real hackers.
positive: The testers were told to use real hacking tools to better emulate an actual attack.
negative: All of the testing was done by an outside security auditing firm.