You jest, but I’ve read somewhere it’s actually reasonable to provide some amount of info or access to pen testers… since they’re just gonna find out anyway, but if you pay them for a week, you might as well not waste the first 3 days to have them figure the basic setup which doesn’t have an effect on the security analysis/outcome.