Our modal project was part of the software engineering budget of a software product company.

I think you may think Matasano was more of an IT shop than it actually was. The term "penetration testing" doesn't do anyone any favors, since it means everything from "running Metasploit" (the kind of work we did not do) to "evaluating firmware".

This is really neither here nor there, right; the more specialized you want to say our work does, the stronger my consulting advice gets.