Frequently Asked Questions
This page answers the most common questions about Nokta Guard's penetration testing and digital forensics services, project process, confidentiality, pricing and reporting. Questions are grouped under six headings, and each answer is written to stand on its own.
Drag and drop, or click.01
Penetration Testing
What is penetration testing?
Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.
What is the difference between vulnerability scanning and penetration testing?
Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.
How often should a penetration test be performed?
The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.
What is the difference between black-box, grey-box and white-box testing?
In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.
How long does a penetration test take?
Duration depends on scope. We confirm the timeline in the proposal after scoping.
What happens if a critical vulnerability is found during testing?
When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.