Pen tests cause outages when nobody agreed the scope, the window or the stop button. A buyer guide to rules of engagement, written authorisation, cloud provider policies from AWS, Microsoft and Google, SOC deconfliction, and the categories where the safe answer is no.