Does anyone know if Netsuite has a published position on the use of 3rd party penetration testing of websites?

Your account manager would be a good place to start asking that question... that said, I'd check your contract. If I were a betting man, I'd say that it is expressly forbidden by your terms of service