Question 1

What is penetration testing?

Accepted Answer

Penetration testing (pentest) is a simulated and authorized cyber attack against your computer systems to identify exploitable vulnerabilities. It's a proactive security assessment that simulates the techniques used by malicious attackers to discover weaknesses before they can be exploited. Our certified specialists use internationally recognized methodologies such as OWASP, PTES, and NIST to ensure a comprehensive evaluation of your security posture.

Question 2

How long does a penetration test take?

Accepted Answer

The duration of a penetration test varies according to scope, complexity, and type of systems being assessed. Basic web application tests may take 3-5 business days, while comprehensive enterprise infrastructure assessments can extend for 2-4 weeks. Factors influencing duration include: number of systems/applications, network size, compliance requirements, and depth of analysis needed. We always provide a detailed timeline during the planning phase.

Question 3

How much does penetration testing cost?

Accepted Answer

Penetration testing costs vary based on scope, complexity, and type of assessment. Basic web application tests start at €2,500, network infrastructure tests from €5,000, and comprehensive enterprise assessments can cost €10,000 or more. Factors influencing price include: number of IPs/URLs, application complexity, compliance requirements, project urgency, and need for specialized testing. We offer free customized quotes after initial analysis of your requirements.

Question 4

Is penetration testing safe for my systems?

Accepted Answer

Yes, our penetration tests are carefully controlled and designed to minimize any risk to your production systems. We use approved methodologies, non-destructive techniques, and coordinate all activities with your IT team. We establish rigorous security protocols, including: testing during agreed hours, security backups, emergency communication channels, and rollback procedures. Our certified specialists have years of experience in critical enterprise environments.

Question 5

What will I receive after the test?

Accepted Answer

After the penetration test, you'll receive a comprehensive and professional report that includes: executive summary for management, detailed findings with risk ratings (Critical, High, Medium, Low), technical evidence with screenshots, specific remediation recommendations, suggested remediation timeline, and technical appendices. We also provide an in-person or virtual debriefing session to explain results, answer questions, and discuss remediation priorities. The report follows international standards and can be used for compliance audits.

Question 6

Do the tests help with GDPR compliance?

Accepted Answer

Yes, our penetration tests are specifically designed to meet GDPR (General Data Protection Regulation) security requirements. We assess technical and organizational measures for personal data protection, identify vulnerabilities that could lead to data breaches, and provide recommendations to implement 'security by design'. Our report includes specific sections on GDPR compliance and can be used as evidence of due diligence for regulatory authorities such as CNPD.

Question 7

How often should I conduct penetration testing?

Accepted Answer

We recommend annual penetration testing at minimum, but the ideal frequency depends on several factors: industry type, regulatory requirements, infrastructure changes, and risk profile. Financial sector organizations may need semi-annual testing, while companies with frequent system changes should consider quarterly testing. We also recommend additional testing after: new system implementations, significant network changes, security incidents, or before important compliance audits.

Question 8

How should I prepare for a penetration test?

Accepted Answer

Proper preparation is crucial for test success. Essential steps include: clearly define scope and objectives, obtain legal and management approvals, inform IT and security teams, prepare system documentation (network diagrams, application inventory), establish emergency communication channels, schedule appropriate testing windows, and designate technical contact points. We also recommend performing security backups and having contingency plans ready.

Question 9

What types of penetration testing do you offer?

Accepted Answer

We offer a complete range of penetration testing services: Web Applications (OWASP Top 10, business logic), Network Infrastructure (servers, firewalls, switches), Mobile Applications (iOS/Android), Social Engineering (phishing, vishing), Red Team Operations (APT simulations), API Testing (REST, SOAP, GraphQL), Cloud Security (AWS, Azure, GCP), IoT Testing, Wi-Fi Assessment, and Secure Code Review. Each type uses specific methodologies and specialized tools for maximum effectiveness.

Question 10

Do you offer support for vulnerability remediation?

Accepted Answer

Yes, we offer comprehensive support for remediation of discovered vulnerabilities. Our services include: specialized consulting for fix implementation, development of prioritized remediation plans, technical support during implementation, re-testing to confirm fixes, internal team training, and continuous security monitoring. We also offer DevSecOps services to integrate security into the development lifecycle and prevent future vulnerabilities.

Question 11

Do the tests help with ISO 27001 certification?

Accepted Answer

Absolutely. Our penetration tests are aligned with ISO 27001 security controls and help demonstrate compliance with various standard requirements. Specifically, they contribute to: A.12.6 (Technical vulnerability management), A.14.2 (Security in development processes), and A.18.2 (Information security reviews). Our report includes specific mapping to ISO 27001 controls and can be used as evidence during certification audits. We also offer consulting for complete ISMS implementation.

Question 12

What's the difference between black box and white box testing?

Accepted Answer

Black Box testing simulates an external attacker with no internal system knowledge - only publicly available information. It's ideal for assessing external security posture. White Box testing provides complete access to source code, documentation, and credentials - enabling deep analysis of internal vulnerabilities. Gray Box testing combines both approaches, providing limited system knowledge. We recommend White Box for secure development, Black Box for realistic external threat assessment, and Gray Box for comprehensive evaluations.

Question 13

How do you test mobile applications?

Accepted Answer

Our mobile application testing follows the OWASP MSTG (Mobile Security Testing Guide) methodology and covers: static code analysis (SAST), dynamic runtime analysis (DAST), network communication testing, local storage assessment, authentication and authorization testing, cryptography analysis, business logic testing, and anti-tampering protection evaluation. We test on real iOS and Android devices, using specialized tools like MobSF, Frida, and Burp Suite Mobile Assistant. We provide platform-specific reports.

Question 14

Do you test security in cloud environments?

Accepted Answer

Yes, we offer specialized testing for cloud environments (AWS, Azure, Google Cloud Platform). Our testing includes: IAM and permissions configuration, storage security (S3, Blob, Cloud Storage), virtual network and firewall configuration, container and Kubernetes assessment, cloud-native API testing, logging and monitoring analysis, compliance evaluation (SOC2, ISO 27017), and disaster recovery testing. We use specialized tools like ScoutSuite, Prowler, and CloudMapper, following frameworks like CSA CCM and NIST Cloud Computing.

Question 15

What does a social engineering assessment include?

Accepted Answer

Our social engineering assessment tests the human factor in security through: simulated phishing campaigns (email, SMS, WhatsApp), vishing tests (phone calls), physical security assessment (tailgating, pretexting), USB drop testing, social media information analysis (OSINT), security policy evaluation, and awareness training. All tests are ethical, controlled, and coordinated with HR. We provide detailed metrics, behavioral analysis, and recommendations for security training programs.

Frequently Asked Questions