Question 1

Is this just an automated scan?

Accepted Answer

No. Scanners are a small fraction of the work and only find what they already know. The value is senior operators manually chaining weaknesses — business logic, authentication, access control — into real attack paths, each documented with reproduction steps. If a proposal only lists tools, you are buying a scan, not a pentest.

Question 2

Black box, grey box or white box?

Accepted Answer

It is about how much we know at the start: nothing (black), user accounts and some documentation (grey), or full source code (white). Grey box gives the best value for most scopes — less time on reconnaissance, more on real attack paths. We help you choose during scoping, and the proposal states it explicitly.

Question 3

Will you break our production?

Accepted Answer

No. We agree on limits before we start, work carefully on anything live, and stop the moment something looks fragile. Destructive tests only happen on environments you point us to.

Question 4

How long does an engagement take?

Accepted Answer

Most tests run one to three weeks of hands-on work. You get the first critical findings within days, not at the end.

Question 5

Will the report satisfy our auditors?

Accepted Answer

Yes. For SOC 2, ISO 27001, PCI DSS, DORA or NIS 2 we map findings to the framework you name, with the methodology and evidence auditors expect. Tell us your audit deadline and we plan the retest window around it.

Question 6

Who exactly will be testing us?

Accepted Answer

Named senior operators. You see their profiles and certifications before kickoff, and the people who tested you are the ones in your debrief. Nothing is subcontracted.

Question 7

Who sees the report?

Accepted Answer

Only the people you name. The report is yours, delivered encrypted, and we delete our copy on request once the engagement is closed.

Question 8

Are you insured?

Accepted Answer

Yes, we carry professional liability cover, and we sign your NDA before any access is shared.

Question 9

Can you retest after we fix things?

Accepted Answer

Yes. A retest to confirm the fixes held is included in every engagement for 3 months after it closes — never billed as an extra.

{{ stT1 }} {{ stAcc }}

{{ stWhyT }}

{{ stPromiseT }}