The crazy thing to me was that the 2015 discovery was reportedly [1] due to a "product demo".

Of course, I expect that the company was entirely legitimate, but running an intrusion detection company would apparently be great cover for gaining free vulnerability scans of potential targets.

[1] http://arstechnica.com/security/2015/06/report-hack-of-gover...