systems. Instead, they use them to test systems for vulnerabilities and only after an organization has granted them explicit permission to do so.