My client has a friend who is doing 'security testing,' and he's telling them that the P