Nokta Guard

The Right Point for Security.

We find your weaknesses before attackers do and examine digital evidence with its integrity intact. Evidence-based findings, clear reports and a process that closes with retesting.

Request a Quote

Penetration Testing

Cloud Security Testing

AI / LLM Security Testing

ICS/OT Penetration Testing

IoT & Hardware Testing

Social Engineering Testing

Source Code Review

Red Team

Purple Team

DDoS Testing

Stress Testing

View All (11)

What we do

We treat cybersecurity as a measurable process, not a one-off check. Depending on your needs, we work in one of the service areas below or a combination of them.

Offensive Security: We test your web, mobile, API, network, cloud and industrial systems using real attacker techniques. Through penetration testing, red teaming and social engineering, we uncover weaknesses before they are exploited.
Digital Forensics: We examine digital evidence on computers, mobile devices, storage media and servers while preserving its integrity. Findings are presented in an objective report that non-technical readers can follow.
Vulnerability & Exposure Management: We monitor your weaknesses continuously through periodic scanning, expert validation and patch tracking. Findings are prioritised by business impact so you can direct resources where they matter.
Risk, Compliance & GRC: We plan the technical tests and reports expected under frameworks such as BDDK, SPK, EPDK, KVKK and PCI DSS. We score your cyber risks and build a roadmap that fits your budget.
Training & Awareness: We deliver security awareness training for employees. Phishing simulations and crisis exercises make the human factor measurable.

View All Solutions

Regulatory and Industry Solutions

Finance and Banking BRSA Penetration Test

We test the critical systems of banks and financial institutions with real attack scenarios, in line with BRSA expectations.

Energy and Critical Infrastructure EMRA Penetration Test

We test the IT and industrial control systems of energy companies in line with EMRA requirements, without putting operations at risk.

Capital Markets CMB Penetration Test

We test the information systems of brokerages and portfolio management firms to the scope expected by CMB regulations.

Card Data Environments PCI DSS Penetration Test

We test your cardholder data environment against the penetration testing requirements of PCI DSS v4.0.1 and deliver an audit-ready report.

Regulation

Solutions by regulation

Many sectors, from banking and energy to payment institutions and e-commerce, are required by regulation to run regular penetration tests. We plan the test and report your regulator expects in one place.

View All Solutions

Methodology

Explore Our Methodology

01 Our Test Methodology

Every engagement follows OWASP, PTES and NIST SP 800-115 guidance through scoping, reconnaissance, controlled exploitation, reporting and retesting, so each result is repeatable and auditable.
02 Test Approaches

Black box, grey box and white box differ by how much information is shared with the test team. In grey box, the most common choice, a user account and limited information are shared.
03 Our Reporting Approach

Our reports combine an executive summary, evidence-backed findings, risk scores and practical remediation. Our benchmark is that your technical team can start fixing without asking further questions.
04 Which Test Is Right for You?

Start with an external network test if you have internet-facing systems, or a web application test if you run a customer-facing application. An internal network test suits Active Directory environments; source code analysis suits software teams.
05 How Are Scope and Pricing Determined?

Price follows the work: the number of applications, endpoints and IP ranges, the roles to be tested, the test approach and any on-site or out-of-hours requirements. We do not publish list prices; every proposal follows a scoping call.
06 How to Choose a Penetration Testing Provider?

Look beyond price: who will perform the test, which methodology will be used, the quality of a sample report, confidentiality and data retention rules, and how retesting is planned.

How does our process work?

Scoping and proposal: We listen to your needs, clarify the systems in scope with a scoping form and prepare a tailored proposal.
Testing or examination: We carry out the test or forensic examination within the limits set by written authorisation and rules of engagement.
Reporting and presentation: We report findings with an executive summary and technical detail, then walk your team through the results.
Retesting: We retest the remediated issues and document closure in a separate retest report.

Why Us?

Why Nokta Guard?

Actionable reporting

Every finding is documented with impact, CVSS score, evidence, reproduction steps and a concrete remediation. The executive summary lets decision-makers see the risk without technical detail.

Confidentiality and secure delivery

We start every engagement under a non-disclosure agreement, deliver reports and evidence encrypted, and keep your data in environments accessible only to authorised team members.

Closure through retesting

We retest the issues you fix and document which ones are closed in a separate retest report. The engagement ends with proven improvement, not just a report.

Regulatory knowledge

During scoping we review the testing and reporting expectations of BDDK, SPK, EPDK, CBRT (TCMB), KVKK and PCI DSS with you, and plan the test around the output your audit will require.

Get to Know Us

1 2 3 4

Smiling security consultant holding an open laptop

News and Blog

Latest Articles

All Articles

Cyber Security Guides

What Is Penetration Testing? Types, Phases and Deliverables

14 October 2026

Comparisons

Vulnerability Scanning vs Penetration Testing: What's the Difference?

7 October 2026

Cyber Security Guides

How Often Should You Run a Penetration Test?

30 September 2026

Comparisons

Black-Box, Grey-Box and White-Box Testing: Which Should You Choose?

23 September 2026

FAQ

Frequently Asked Questions

What kinds of organisations does Nokta Guard work with?

Nokta Guard works with organisations across finance, energy, healthcare, e-commerce, manufacturing and the public sector. On the forensics side, we also handle examinations for law firms, companies running internal investigations and individual clients. We scale each engagement to the size and needs of your organisation.

We don't know which test we need. Where should we start?

In a short initial call we review your systems, regulatory obligations and priorities. Based on that, we recommend whether an external network, web application, internal network or mobile application test should come first. Filling in our scoping form speeds this up.

What is a retest and why does it matter?

A retest is the re-examination of penetration test findings after they have been remediated. It shows whether each fix actually works, and closed findings are documented in a separate report. Many audits also expect proof that findings have been resolved.

What is the advantage of getting penetration testing and digital forensics from the same company?

After a security incident you often need to investigate how it happened and also test whether similar weaknesses exist elsewhere. Working with one team means findings move between the two without getting lost. Each engagement still runs under its own methodology and report.

How can I reach you for an urgent incident or evidence examination?

For urgent matters, call us directly on +90 216 606 16 22. If devices may hold evidence, call us before switching them off, turning them on or continuing to use them. We carry out an initial assessment by phone and plan the next steps with you.