What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Does ISO 27001 require penetration testing?

The standard does not mandate penetration testing by name, but requirements such as technical vulnerability management and measuring control effectiveness make regular penetration testing a common form of evidence. Certification auditors frequently ask for it.

Does KVKK require penetration testing?

The Law does not name specific test types; it requires technical measures that ensure an appropriate level of security. The Authority's Personal Data Security Guide lists penetration testing among technical measures and recommends regular vulnerability scanning and penetration testing.

What are KVKK technical and administrative measures?

Technical measures are system-side controls such as authorization, logging, encryption, network and application security, backup and penetration testing. Administrative measures cover organizational controls such as inventory, policies, contracts, training and internal audit.

Is a legal advisor enough for KVKK compliance?

Legal advice is essential for legal processes, but verifying that technical measures actually work requires system review and testing. Compliance is most consistent when legal and technical teams work from the same inventory.

What should we do after a data breach?

A breach must be notified to the Board, and to data subjects where required, under the procedures and time limits set by the Board. Logging and response processes that allow fast detection need to be in place in advance.

What is the difference between a vCISO and a full-time CISO?

A full-time CISO is an in-house executive. A vCISO takes on the same responsibilities as an outsourced service, with time and scope set to the organization's needs. The model is especially flexible for small and mid-sized organizations.

How much time does a vCISO dedicate?

Time commitment is set in the contract based on organization size, regulatory load and program maturity. Monthly and quarterly governance meetings are fixed; other work is scheduled as needed.

Does a vCISO help with regulatory compliance?

Yes. A vCISO tracks the requirements of the regulations and standards you are subject to and schedules the required policy, risk analysis and testing work. Some regulations may require certain roles to be appointed internally; we review this with you at the outset.

How does a vCISO work with our IT team?

The vCISO owns strategy, prioritization and management reporting, while your IT team handles implementation. Regular meetings and a shared action list keep both sides on the same plan.

How often must banks in Turkey run penetration tests?

The BDDK Regulation on Banks' Information Systems and Electronic Banking Services requires penetration testing by independent teams at least once a year. Additional testing after significant system changes is also good practice.

Who does the SPK Information Systems Management Communiqué apply to?

It governs information systems management for institutions regulated by the Capital Markets Board, with exemptions from certain provisions depending on institution type. We confirm which articles apply to you against the current text.

Which companies does the EPDK cybersecurity competency model affect?

It covers licensees in areas such as electricity transmission and distribution, generation facilities above certain thresholds, natural gas, crude oil transmission and refining. Its scope has been extended by amendments, so assessments should rely on the current text.

Can your report be submitted directly to the regulator?

Our reports include an executive summary, methodology, findings and remediation guidance, structured around the headings the regulation expects. Any institution-specific format requirements are agreed during scoping.

When did Turkey's Cybersecurity Law No. 7545 enter into force?

The Law was published in Official Gazette No. 32846 on 19 March 2025 and entered into force on the same day.

Does the Cybersecurity Law apply only to public institutions?

No. Besides public institutions, it covers natural and legal persons operating in cyberspace. Some obligations, however, apply only to public institutions and critical infrastructure.

How quickly must cyber incidents be reported?

The Law requires vulnerabilities and incidents to be reported to the Presidency without delay and does not set a fixed number of hours. Since details are expected in secondary regulations, it is important to have internal detection and escalation processes ready now.

What penalties does the Law provide?

The Law provides administrative fines for breaches of security and reporting obligations and criminal sanctions for certain acts. Amounts are revalued annually, so check the current legal text and consult your legal advisor for up-to-date figures.

How is a cyber risk assessment different from a penetration test?

A penetration test finds weaknesses in specific systems from an attacker's perspective. A risk assessment combines such findings with threats, business impact and existing controls to rank risks across the organization. The two complement each other.

How long does a risk assessment take?

It depends on the size of the organization and the number of processes in scope. We confirm the timeline in the proposal after scoping. we share an exact timeline after the initial call.

How often should a risk assessment be repeated?

At least once a year and after significant changes such as new systems, mergers or a serious incident. Some regulations explicitly require an annual risk analysis.

Which methodology do you use?

We build on international guidance such as ISO/IEC 27005 and NIST SP 800-30 and adapt the scoring scale to your risk appetite. The scale and criteria used are stated clearly in the report.

Is threat intelligence only for large organizations?

No. Scope can be adjusted to the size of the organization; for a smaller organization, dark web monitoring and attack surface management are often the starting points that deliver value fastest.

Is a threat intelligence feed the same as an intelligence service?

No. A feed is usually a list of IOCs with limited context. An intelligence service relates that data to your organization, analyzes it and turns it into prioritized recommendations.

How is the confidentiality of shared intelligence protected?

We use Traffic Light Protocol (TLP) labels, which state who information may be shared with. Organization-specific findings are shared only with authorized people.

Is dark web monitoring legal?

Yes, when it is carried out as passive monitoring of sources that are publicly or legitimately accessible. Nokta Guard does not buy data, does not interact with those engaged in criminal activity and does not attempt unauthorized access.

Can you get our leaked data removed from the internet?

Removing data from dark web sources is generally not possible. Our focus is reducing the impact of the leak: changing passwords on affected accounts, revoking sessions and putting additional security controls in place.

Do you monitor employees' personal accounts?

The default scope is your corporate domains and assets belonging to your organization. Scope is defined with regard to the legal framework and agreed with you in writing.

What is an infostealer log?

An infostealer is malware that collects passwords saved in the browser, session cookies and system details from the device it infects. These logs are sold on underground markets and can be used to gain unauthorized access to corporate systems.

What is the difference between EASM and vulnerability scanning?

Vulnerability scanning usually runs against a known list of assets you provide. EASM first discovers which assets are actually exposed to the internet, bringing unknown assets into scope as well.

What is shadow IT?

Shadow IT refers to systems, applications and cloud services used without the knowledge or approval of IT and security teams. Because they are not monitored or patched, they can be an easy entry point for attackers.