What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

When will Nokta Guard PAM be available?

Nokta Guard PAM is currently in development. Contact us to request early access or a demo; we share the current status during the call.

Do we need a WAF if we already have a firewall?

Usually yes. A firewall controls network and application traffic by policy, while a WAF inspects the content of HTTP/HTTPS requests for a specific web application to filter attacks such as SQL injection and XSS. They complement each other at different layers.

Which network security product should we start with?

It depends on your attack surface and existing controls. A needs assessment identifies missing layers so we can prioritise the steps that reduce the most risk.

Can you review the rules on our existing devices?

Yes. Our Firewall Rule Review service identifies redundant, overlapping and risky rules and reports clear remediation recommendations.

Is my ISP's DDoS protection enough?

ISP protection is an important layer against volumetric attacks, but it may not always cover application-layer attacks. We recommend reviewing its scope, response time and thresholds against your contract.

How do we know our DDoS protection works?

The most reliable way is a controlled DDoS test coordinated with your ISP and other parties. It shows at what threshold and how quickly protection is triggered.

Does cloud DDoS protection see our traffic?

With cloud scrubbing, traffic passes through the provider's infrastructure during an attack or continuously. We clarify how TLS traffic is handled and where data resides during selection.

What is protective DNS?

Protective DNS is a DNS service that uses threat intelligence to block lookups for domains known to be malicious. Even if a user clicks a malicious link, the connection can be stopped before it is made.

Does DNS security replace a firewall?

No. DNS security is an early blocking layer at the domain level; on its own it does not stop direct-to-IP connections or content-based threats. It should be used alongside a firewall and SWG.

Can DNS over HTTPS (DoH) bypass the control?

Browsers or applications using their own DoH resolvers can bypass DNS policy. We address this risk through endpoint settings and firewall rules as part of the deployment.

What is the difference between NGFW and UTM?

UTM combines firewall, antivirus, web filtering and VPN in one device, typically for small and mid-sized networks. NGFW emphasises application and user awareness, integrated IPS and enterprise-grade performance. Many products now cover both, so the choice should follow your requirements.

Does TLS inspection affect performance?

Yes, inspecting encrypted traffic adds processing load on the device. We size devices for the expected throughput with TLS inspection enabled and verify it with real traffic during the PoC.

Can you migrate our existing firewall rules?

Yes. Rather than copying rules one-to-one, we first remove redundant and risky rules and then migrate the cleaned-up rule base.

Do we need to replace all switches to deploy NAC?

Usually not. Most enterprise switches and wireless infrastructure support 802.1X and RADIUS. Alternatives are assessed for older devices that do not, and the needs assessment clarifies the situation.

What about devices that do not support 802.1X?

Printers, cameras and some IoT devices can be handled with MAC-based authentication combined with profiling. These devices are also placed in a restricted network segment to reduce risk.

Will users be affected during NAC rollout?

We start in monitor mode to observe the device inventory and policy impact. Enforcement is switched on in phases once exceptions are clear.

Why would we need a packet broker?

Switches have a limited number of SPAN ports and limited capacity, which falls short when several tools want the same traffic. A packet broker collects traffic in one place and distributes it appropriately to each tool.

What is the difference between a TAP and a SPAN port?

A TAP is hardware inserted into a link that captures a full copy of the traffic. A SPAN port is configured on a switch and may drop packets under heavy load. TAPs are usually preferred at critical monitoring points.

Can a packet broker decrypt TLS traffic?

Some models offer TLS decryption, but it is not required in every scenario. Whether you need it depends on the connected tools and your privacy policies.

Does a WAF replace secure coding?

No. A WAF is an additional layer that reduces known attack patterns, but it cannot always catch flaws such as business logic errors. The lasting fix is correcting the vulnerability in source code.

Cloud WAF or on-premises WAF?

A cloud WAF is quick to deploy and can come with DDoS protection, while an on-premises WAF suits cases where traffic must not leave your infrastructure. We choose based on hosting model and regulatory requirements.

Should a WAF be tested after deployment?

Yes. A web application penetration test after deployment shows how the WAF behaves against real attack techniques and where it can be bypassed.

What is the difference between an SWG and a firewall?

A firewall controls all network traffic by policy. An SWG focuses specifically on user web access and offers deeper control over URL categories, download scanning and per-user reporting.

Are remote users protected as well?

With a cloud-delivered SWG or an on-device client, the same policy can apply wherever the user connects from. The method depends on the chosen architecture.

Does web monitoring raise privacy concerns?

Monitoring employee internet traffic can count as processing personal data under data protection law. We recommend reviewing notices and policies with your legal team before deployment.

Do we still need PAM if we use MFA?

Yes. MFA verifies the identity of the person signing in, while PAM controls and records who uses admin accounts, when and how. The two complement each other.

When is an HSM required?

HSMs are used for payment systems, PKI and certificate infrastructure, electronic signatures and wherever high-value encryption keys must be protected. Whether you need one depends on regulation and your use case.

Can you assess our Active Directory security as well?

Yes. Our AD Security service identifies attack paths in your domain so existing risks are clear before you choose identity products.

What are the FIPS 140-3 security levels?

FIPS 140-3 defines four security levels for cryptographic modules. Level 1 covers basic requirements, Level 2 adds tamper evidence and role-based authentication, Level 3 adds identity-based authentication and response to physical tampering, and Level 4 adds protection against environmental attacks.

Cloud HSM or on-premises HSM?

A cloud HSM is quick to deploy for cloud workloads and leaves hardware maintenance to the provider. An on-premises HSM is preferred where physical control of keys and data residency requirements come first.