Vendor red flags for penetration testing: hourly billing with no cap, accounts registered to them, no post-launch support, and vague timelines. Penetration Testing avoids all four by design.