Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that:
"during the pentest there exist the possibility to delete or modify sensitive data in the production environment unintentionally due to the execution of some tools, exploits, techniques, etc."
The client says that he is not going to accept that clause and that he believes that no company would accept that clause. He thinks that during a pentest information could be accessed but never deleted or modified.
We know that the execution of some tools like web crawlers or spiders can delete data if the web application is very badly programmed, so the possibility always exists if those types of tools are going to be used.
I know that these are the conditions of the client, and should be accepted, but:
Can a skilled and professional pentester always assure that no data will be deleted or modified in production during a pentest?
Can a pentest really be done if the pentest team has the limitation that data cannot be created nor modified?
Should the pentesting company always include the disclaimer clause just in case?