[beardedwizard]

Really not true at all, it's a matter of contract negotiations and deal sizes.

[tptacek]

You do not have a general right. Obviously, 3rd-party penetration tests exist, and obviously there are a variety of things you can do short of actual testing to "check" security.