Be careful! People are not always reasonable about security testing, and if they're in the middle of an active investigation about a compromise, you can get slurped up into it by poking at them. That's a time suck and a hassle you do not want.