[PEN-TEST] Ethics Scenario

["Christopher M. Bergeron" <ChrisB () HGSS COM>]

Here's a scenario that I'd like to get peoples' input on:

A) Our company does pen-tests, security auditing etc...
B) Our team finds a vulnerability/hole on a website just by poking around / using the site.

The question is this:
Do we tell the website company who we are and that we have discovered a vulnerability and then offer to provide them 
assistance with the vulnerability (for pay of course).  i.e. offering them a full pen-test or an IDS or something...?


Or does this tend to fall into the "chasing ambulances" type of business marketing strategy?