What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Our guest network uses a separate internet line. Do we still need a test?

Yes. Even with a separate line, a configuration error can allow access from the guest network to the corporate network or management interfaces; the test confirms the separation actually works.

Are iOS and Android tested separately?

Yes. The two platforms have different security models and storage mechanisms, so each is tested separately and reported under its own heading. Shared backend APIs are tested once.

Do you test the store version or a test build?

Either. A test build (e.g. TestFlight or a signed APK) is preferred; if you want to measure protections such as obfuscation or root detection, the store version is reviewed as well.

Are backend APIs tested too?

The APIs the app uses are in scope by default, because many mobile app flaws come from missing authorisation checks on the backend. If there is a separate, larger API estate, we plan it together with API and Web Service Penetration Testing.

How long does a web application penetration test take?

It depends on the size of the application and the number of roles. We confirm the timeline in the proposal after scoping.

Is testing done in the live environment?

Preferably in a test environment configured like production. If testing must happen in production, any step that could change data or affect the service is approved in advance and run in an agreed time window.

Do we need to give you source code access?

No. Sharing source code (white box) makes testing deeper and more efficient; if you also want the code reviewed, it can be planned together with our Source Code Analysis service.

Are fixes verified after the engagement?

Yes. After you remediate, we retest the same issues and document whether each one is closed in a separate retest report. The scope and timing of the retest are set out in the proposal.

Is social engineering testing legal?

When performed with written approval from an authorized representative and within a defined scope and rules, it is an authorized security assessment. Personal data is handled in line with KVKK. We also recommend consulting your own legal team.

What is the difference between a phishing simulation and social engineering testing?

A phishing simulation is a recurring email campaign used to track awareness over time. Social engineering testing is a more targeted, broader assessment that uses multiple channels, including phone and physical entry.

When should we run a stress test?

Before launching a new application, after major infrastructure changes and ahead of high-traffic periods such as campaigns or registration windows.

Should the test run in production?

A production-like test environment is preferred. If measuring real capacity requires production, testing is done in a maintenance window, with providers notified and load increased gradually.

Does stress testing find security vulnerabilities?

No. Stress testing focuses on performance and capacity. To assess application security we recommend a penetration test, and for resilience against attack traffic, a DDoS test.

What is prompt injection?

Prompt injection is when an attacker uses inputs to alter or override a system's instructions to the model. It can be direct, through a user message, or indirect, through instructions hidden in a document or web page the model reads.

We use a third-party model API, not our own model. Do we still need testing?

Yes. Most risks come not from the model itself but from the permissions it is given, the data sources it connects to and how its output is handled. Testing focuses on your integration.

Do you attack the model provider's systems?

No. Testing covers only your application and your integrations, within a written scope, and respects the provider's terms of use.

What is GRC?

GRC stands for governance, risk management and compliance. It ensures information security decisions are consistent with business goals, acceptable risk levels and legal obligations.

How is a compliance assessment different from a penetration test?

A compliance assessment checks whether the requirements of a regulation or standard are met. A penetration test technically measures how well systems withstand a real attack. Many regulations require regular penetration testing as part of compliance, so we run both in a way that feeds each other.

Who needs these services?

Regulated organizations such as banks, brokerage and asset management firms and energy licensees, as well as any company that wants to make its cyber risk measurable. A short initial call is usually enough to clarify what you need.

Who must comply with the Information and Communication Security Guide?

The Guide applies to public institutions, critical infrastructure operators and organizations providing IT services to them under contract. For critical infrastructure, details of the audit obligation may also be set by sector regulations.

What is the current version of the Guide?

The first version was published in July 2020. Version 1.1, published by the Cyber Security Presidency in March 2026, reflects changes in institutional responsibilities; the current text is available on the Presidency's website.

How often is the Guide audited?

Implementation of the Guide must be audited at least once a year. Audit procedures and auditor qualifications are defined in the Information and Communication Security Audit Guide.

How does the Guide relate to ISO 27001?

They support each other, but one does not replace the other. The Guide defines national minimum measures by criticality level, while ISO 27001 establishes a risk-based management system. Mapping ISO 27001 controls to the Guide's measures helps avoid duplicate work.

What is the most effective defense against ransomware?

No single control is enough. Immutable or offline backups that are tested regularly, MFA on privileged accounts, segmentation and a monitored EDR solution work together. Our assessment shows which of these layers is weakest in your environment.

What is the 3-2-1 backup rule?

Keep at least three copies of your data on two different media types, with one copy stored offsite. Against ransomware, at least one copy should also be immutable or disconnected from the network.

Will the assessment disrupt our systems?

No. The work relies mostly on configuration review, interviews and controlled queries, and no ransomware is executed. If additional technical testing is needed, we agree the rules with you in advance.

Can we run an exercise after the assessment?

Yes. We can turn the findings into a ransomware scenario and run a tabletop crisis exercise with management and IT teams to test decision-making and communication plans.

How long does ISO 27001 certification take?

It depends on the organization's size, scope and current maturity. We confirm the timeline in the proposal after scoping.

How many controls are in ISO/IEC 27001:2022?

Annex A contains 93 controls grouped into four themes: organizational, people, physical and technological. Which controls apply is justified in the Statement of Applicability based on the risk assessment.

Is my ISO 27001:2013 certificate still valid?

No. The transition to the 2022 edition ended on 31 October 2025, and certificates issued against the 2013 edition are no longer valid. If your certificate lapsed without transition, you will need to plan for recertification.