correct me if im wrong, but i see some flaws on either the CFO's side as the pentesters side. Dave acted correctly from the moment he discovered the "hack". The CFO should have never given permission to attack the availablity of the infrastructure, and the pentesters should have never kicked up that much dust to get detected. however, when compromising the availablity of the infrastructure, youre pretty sure you will be detected.