I'm plumping for the latter, because the chances of them *all* choosing the same company with no background in cybersecurity to lock down their tests is pretty slim unless there was some specific reason for it.