Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Penetration Testing & Forensics FAQ

Q: What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

When and where was Nokta Guard founded?

Nokta Guard Siber Güvenlik Teknolojileri A.Ş. was founded in Istanbul in August 2026. Our head office is in Kartal, Istanbul.

What services does Nokta Guard offer?

Our current focus areas are penetration testing and digital forensics. We test web, mobile, API, network and cloud environments, and we examine and report on digital evidence while preserving its integrity.

Does Nokta Guard act as a court-appointed expert witness?

No, Nokta Guard is not a court-appointed expert. We prepare objective digital forensics reports as expert opinion and technical consultancy; how a report is assessed legally is at the discretion of the relevant authority.

Why is your reference list short?

Cybersecurity work requires confidentiality, and many organisations prefer not to disclose their security providers. We therefore only list organisations that have given written permission.

Do you share engagement details as references?

No. Findings, scope and technical details are confidential and are never shared for reference purposes. Only the approved organisation name and logo are published.

Can we speak to one of your reference clients?

You can raise this request during the proposal process. If the organisation agrees, a conversation can be arranged.

Which certifications should penetration testers hold?

Certifications with hands-on exams are valuable in penetration testing because they show a specialist can find and exploit vulnerabilities in a realistic environment. We list our team's certifications on this page, grouped by area.

Which methodology do you use for testing?

We follow OWASP guides for web and mobile testing, and PTES and NIST SP 800-115 for the overall process. Findings are scored with CVSS and delivered in a report with an executive summary and technical detail.

Which standard do you follow in digital forensics?

Our examinations follow an approach aligned with the principles of ISO/IEC 27037 for collecting and preserving digital evidence. Chain-of-custody records and hash verification are core parts of that approach.

What is Nokta Guard's mission?

Nokta Guard's mission is to find organisations' vulnerabilities before attackers do and to investigate digital incidents on the basis of evidence. We aim to close every engagement with actionable recommendations.

What is Nokta Guard's vision?

Our vision is to become a technology company that turns field experience into reliable services and home-grown cybersecurity products. To that end, we carry out R&D.

Does Nokta Guard only provide services, or does it also build products?

Today we provide penetration testing and digital forensics services. We carry out R&D to turn our field experience into domestic cybersecurity solutions; we have no product on sale at present.

Which standards do you use in penetration tests?

We follow the OWASP Web Security Testing Guide for web applications, OWASP MASTG for mobile applications and the OWASP API Security Top 10 for APIs. We draw on PTES and NIST SP 800-115 for process and scope management and on OSSTMM for measurement. Findings are scored with CVSS and mapped to MITRE ATT&CK where relevant.

Can you adapt your methodology to our needs?

Yes. The core steps stay the same, but testing depth, testing windows and report format can be adapted to your needs or your regulator's expectations. Any adjustments are agreed in writing during scoping.

How is evidence integrity preserved in a forensic examination?

Evidence is logged with a handover record, imaged using a write-blocker where possible and verified with hash values. Analysis is carried out on the verified copy, not the original. See our Digital Forensics Methodology page for details.

Why does chain of custody matter?

Chain of custody is the record of who held a piece of digital evidence, when and for what purpose, from the moment it was obtained. A complete record helps demonstrate that the evidence has not been altered. A broken chain can lead to the reliability of the evidence being questioned.

How does a hash value show that evidence has not been altered?

A hash is a fixed-length value calculated from the content of data, and even the smallest change in content produces a different value. If the hash values of the original source and the forensic image match, it is technically demonstrated that the copy is identical to the original. That is why hash values are recorded in the handover form and the report.

What should I do before sending a device for examination?

We recommend that you stop using the device, do not run data recovery software on it and, if possible, leave it in its current state. Whether to switch off a running device depends on the purpose of the examination, so contact us first. Noting where, when and from whom the device was obtained helps the chain of custody.

Can your forensic report be used in court?

Our reports present technical findings in an auditable way, together with methods, tools and hash values. Whether the report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

What should we prepare before a penetration test?

Have a list of in-scope systems, their access addresses and, where needed, test accounts ready. If your hosting or cloud provider requires notice before testing, that should also be handled. Our scoping form lists everything you need to prepare, step by step.

What are rules of engagement?

Rules of engagement are a written document that defines which systems will be tested, on which dates and times, with which methods, and what is out of scope. It also lists emergency contacts and the conditions under which testing will be stopped. It provides the legal and operational safeguards for the test.

When does the retest take place?

The retest is scheduled after you tell us findings have been fixed, within the period set in the proposal. Only findings in the original report are retested; any new scope is assessed separately. Results are delivered in a separate retest report.

What should a good penetration test report include?

A good report contains a clear summary for executives and reproducible findings for technical teams. Each finding should include impact, CVSS score, evidence, reproduction steps and concrete remediation. Nokta Guard reports follow this structure and are completed with a retest report.

How long does it take to receive the report?

The delivery time is stated in the proposal and depends on the size of the scope. Critical findings are reported to your contact as soon as they are identified, without waiting for the report, so urgent issues lose no time.

Can we use the report for an audit or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Which methodology should a penetration test follow?

No single methodology is enough for every system. OWASP WSTG is the reference for web applications, OWASP MASTG for mobile and the OWASP API Security Top 10 for APIs, while PTES and NIST SP 800-115 are widely used for process management. Nokta Guard combines these frameworks according to the type of system being tested.

Will a penetration test affect our live systems?

Tests are planned and executed in a controlled way to avoid service disruption. Steps that carry a risk of downtime are carried out only with your approval and within the agreed testing window. We still recommend taking backups of critical systems and keeping a contact person available during testing.

What is a CVSS score and how are findings rated?

CVSS (Common Vulnerability Scoring System) is an open standard maintained by FIRST that rates the technical severity of a vulnerability from 0 to 10. We score findings with CVSS and then assign a risk level that also reflects the business impact in your organisation. We agree on the CVSS version (3.1 or 4.0) during scoping.

Are you a reseller for a specific brand?

No. For third-party solutions we work vendor-neutrally and base our recommendation on the needs assessment, test results and total cost of ownership. We explain why each option is recommended.

Can you help deploy a product we bought elsewhere?

Yes. We can support deployment, integration and configuration hardening for security products you already own or have just purchased. Scope depends on the product type and your infrastructure.