Will an IT consultation include penetration testing