There are plenty of companies who perform pen testing and security. Their biggest deficiency right now is understanding new emerging cloud technologies. We have been working with some pretty big name security companies around the globe and very few of them understand AWS or Azure adequately.