What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

When should a retest be performed?

After your team has completed the fixes, typically a few weeks to a few months after the original report. A separate, earlier verification can be planned for critical findings.

Is a retest a new penetration test?

No. A retest only checks whether the findings in the previous report have been closed; it is not a full test for new vulnerabilities.

Can you verify findings from another provider's report?

Yes, provided the report contains enough technical detail to reproduce the findings. We review it first and agree on scope and feasibility.

Can the verification report be used in audits?

The report documents when and how each finding was retested and the result, so it can be presented as evidence in internal and external audits. Whether it is accepted is at the auditor's discretion.

How often should vulnerability scans be run?

A common approach is weekly or monthly scans for critical and internet-facing systems and monthly or quarterly scans for internal networks. The right frequency depends on how quickly your environment changes and the regulations you are subject to.

What is a false positive and why remove it?

A false positive is a vulnerability reported by a scanner that does not actually exist. Left in place, false positives waste remediation effort and erode trust in the report, so our specialists validate critical findings.

Is every high CVSS vulnerability urgent?

Not always. CVSS measures technical severity, not the likelihood of exploitation, so we also weigh the EPSS probability, presence in the CISA KEV catalog and the criticality of the affected system.

Will scanning affect our systems?

Scans are generally low-impact. For sensitive systems we agree in advance on scan windows, throttling settings and exclusions.

Can vulnerability management replace penetration testing?

No. Scanning finds known weaknesses at scale, while a penetration test shows how far those weaknesses can actually be exploited. Together they give a more complete picture.

How soon will you respond after I submit the form?

Once we receive your request, our team will contact you by email or phone as soon as possible. For urgent matters, we recommend calling +90 216 606 16 22 rather than waiting for a reply to the form.

Do we need to meet in person to get a quote?

No. Most of the proposal process can be handled by phone, email and online meetings. If you prefer, we can also meet at our office in Kartal.

How can I hand over a device for forensic examination?

After the initial call, you can bring the device to our office on the agreed date. At handover, device details and the chain of custody are recorded on a handover form. We plan the handover method with you during the initial assessment.

Does Nokta Guard offer internships?

Yes, we consider applications from internship candidates. If there is no open internship listing, you can apply through the general application form and select internship as your area of interest.

Can I apply without a cybersecurity certification?

Yes. Certifications are an advantage but not the only criterion; we look at your knowledge, lab and CTF experience and your willingness to learn as a whole.

How can I apply if there are no open positions?

You can send your CV and area of interest through the general application form. When a suitable position opens, we will review your application and get in touch.

Where can I follow your job openings?

We publish current openings on this page. We may also announce them on our company social media accounts.

Can I apply for more than one position?

Yes, you can apply separately for each position you are interested in. We review your applications together and contact you about the most suitable role.

How long is my application kept under review?

Applications are reviewed while the listing is open. The retention period for your personal data is set out in the privacy notice.

How long is my general application kept?

The retention period for your application and your rights regarding your personal data are set out in the candidate privacy notice. If a suitable position opens during that period, we will review your application again.

What format should my CV be in?

Please upload your CV as a PDF of no more than 5 MB. Make sure it includes your current contact details.

How can I find out the status of my application?

If you are shortlisted for a suitable position, our team will contact you by email or phone. For any questions, you can write to info@noktaguard.com.

Can I do my compulsory internship at Nokta Guard?

Yes, if the programme term and places allow, we consider compulsory internship applications. We complete your university's internship paperwork together after you apply.

Do interns work on client projects?

No. Interns do not access client systems or data; all work is done in our in-house lab under a mentor's supervision.

Do interns receive a certificate?

Internship documents will be completed by the relevant team manager.

How often do you publish blog posts?

We publish blog posts regularly; subscribe to our newsletter to hear about new content.

Can we use your content in internal training?

You may share our content with attribution and a link to the original. If you need training material tailored to your organisation, we can plan it together through our Training & Awareness services.

Can I suggest a topic?

Yes. Send us your topic via the contact form or info@noktaguard.com. We take suggestions into account when planning new content.

Why is authorisation so important in penetration testing?

Testing a system without its owner's written permission is unauthorised access, even with good intentions. That is why every engagement starts with signed authorisation and a written scope.

How are client data and reports protected?

We begin every engagement with a confidentiality commitment and deliver reports and data only to authorised people over encrypted channels. Project data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

What if the test finds no vulnerabilities?

Finding no vulnerabilities is also a result, and we report it honestly. The report clearly sets out what we tested, the methods we used and the limits of the scope.