Is it considered a best practice to alternate the vendor used to perform penetration tests? For example if it is your policy to conduct a third-party penetration test semi-annually you would have vendor A conduct the penetration test in the first half of the year and vendor B conduct another penetration test in the second half of the year.
Ideally you would be alternating between two trusted partners. The idea being that no one person/company is perfect. With that said is this practical and do the benefits justify expending the time/effort/money required to build two solid relationships.