Maybe they're really experts and have good nmap scripts https://nmap.org/book/man-nse.html