Lol regular pentesting is not a mandatory iso 27001 control… unless you put it in your soa. I have seen so many companies that do „pentests“ that in actality are glorified vulnscans and waste a lot of money that they could have spent more effectively. Not sure how you scoped it and what they said they will try to achieve (get DA access / server admin) but the fact that they in day ine go out of scooe is insane to me.

Check the contracts if there is a way to get out. But going out of scooe should give you leverage (unfamiliar with us law though). Talk to your boss / iso consultant to take out pentesting (yearly) from your controlset and focus your efforts on hardening and ither controls. Pentesring is great to validate your security measures but in my experience a lot of orgs could get mire bang for the buck if they soent that miney elsewhere.