The pentesters wouldn't have to actually pwn a laptop, just getting the employee to download and run anything could go in a report without having the file actually be malicious.

Would they have legal right to do that, out of curiosity?

Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.

Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.

Then that is something the pentesters cannot do, but malicious actors will do.

Game over.

What pentesters can do, should do, and often do is simply start the test from a workstation that is given to them - you simply assume a successful social engineering as the starting point, and test whether your process and technical controls can properly limit the impact of such a compromise.

Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.

Pen testers generally won’t physically assault your employees, bring guns and wave them around or shoot people, or kidnap their family members and torture them until they do what they want. What’s your point? Nothing.

I think my security form said something along the lines of “using personal laptops to access company resources grants implicit permission for my company to audit my laptop.” It goes on to explain that if you don’t agree to it, simply use the company device only.

Companies don't try to set up job interviews to test their employees loyalty?

Everyone has their price. It is foolish to think that most people would not leave for better title/pay/job alignment/whatever.

Well also to test that they don't just casually drop corporate secrets...

fake interviews might be excessive but lots of companies send tempting phishing emails as part of the secops, then both collect org-level stats and educate (or shame depending on your take) the employee for getting duped.

> responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters.

If your laptop is successfully compromised by the pentesters then pretty much by definition you weren't being responsible. Though I agree that pentesters going after personal devices is ethically dubious.

Compromising employee personal devices is strictly out of scope for any security testing I've seen.

> Though I agree that pentesters going after personal devices is ethically dubious.

It's not just ethically dubious. It crosses a lot of legal boundaries. A company can consent to have their personal devices hacked. An employee doesn't automatically consent to let a company's contractors access their personal devices.