The security of a VPN is based on its authentication and encryption protocols. If a VPN's cryptography is weak, Mudge and Schneier observe, then its security is no better than a non-private network routed over the Internet. And indeed, it is distinction that can be very useful. Unfortunately, it isn't cut and dried, it isn't a simple duality of black and white, there is a lot of gray area. The point is that you must proceed with caution, decide for yourself where to draw the line, and then explore these issues with those you are considering hiring as consultants or in-house security experts for penetration testing or security assessments.
Background checks are helpful, references are vital.
But whatever decisions you make in regard to who you want banging on your systems, it is imperative that you avail yourself of the critical information that is out there.