It realy depends on the ISP. Such as Charter for example. They expressly forbid it. This is from their TOS:

2. NO ILLEGAL OR FRAUDULENT USE
You agree that you will not use, nor allow others to use, Charter Pipeline to violate any applicable federal, state, local or international laws. You agree that you will not use, nor allow others to use, Charter Pipeline to commit a crime or fraud, or to plan, encourage or help others to commit a crime or fraud, including but not limited to engaging in a pyramid scheme, a ponzi scheme or sending chain letters.

7. NO “HACKING"
You agree that you will not use, nor allow others to use, Charter Pipeline to access the accounts of others or to attempt to penetrate security measures of Charter Pipeline’s or other computer systems (“hacking”) or to cause a disruption of service to other on-line users. You agree that you will not use, nor allow others to use, tools designed for compromising network security, such as password guessing programs, cracking tools, packet sniffers or network probing tools.

8. NO SYSTEM DISRUPTION
You agree that you will not use, nor allow others to use, Charter Pipeline to disrupt Charter's network or computer equipment owned by other Charter Pipeline customers. You also agree that you will not use, nor allow others to use, Charter Pipeline to disrupt other Internet Service Providers or services, including but not limited to by e-mail bombing or the use of mass mailing programs.

Most ISP's are about the same. Just call them and ask. It' never hurts. I have a commercial Charter account and I called them and told them what I do for a living and that I would be using security tools across my network and on my clients networks remotely. So they said thats fine. So I get it in writing from my clients. I draw up a non-disclosure and permission agreement between me and my clients to cover my butt.