Cybersecurity firms get deep access to sensitive systems, but who checks they are competent?