A company I worked for got pentested by QinetiQ, both pentesters were thoroughly nice guys and could probably have been blackhatters. They were very efficient, they left zero traces and avoid just going "We exploited X attack vector" and actually dug around the systems to see what they could get. If you hire a pentester get guys like that, as it's the closest you ever want to get to a real world attack.