What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Is an HSM the same as a key management system (KMS)?

No. A KMS is the software layer that manages key lifecycle and policy. An HSM stores keys with hardware assurance and performs operations; many KMS products use an HSM to protect keys.

Which MFA method is the most secure?

FIDO2/WebAuthn hardware keys and passkeys are considered among the most resistant to phishing sites. SMS codes are more exposed to SIM swapping and phishing.

What is MFA push fatigue?

It is when an attacker with a stolen password triggers repeated sign-in attempts, flooding the user with approval prompts until one is accepted by mistake. Number matching and phishing-resistant methods reduce this risk.

Our legacy apps do not support MFA. What can we do?

Options such as a gateway, proxy or RADIUS-based integration can be evaluated for these applications. The right method depends on the application's architecture.

What is the difference between IGA and IAM?

IAM (identity and access management) is a broad field covering authentication and access control. IGA is the governance part of it, focused on the lifecycle, approval and periodic review of access.

Why are access reviews necessary?

Users who change roles accumulate old permissions over time. Periodic reviews identify and remove unnecessary access and are an expected control in many audit frameworks.

Where should an IGA project start?

Projects usually start by connecting the HR system as the authoritative source and the directory service, then bringing the most critical applications into scope. A phased approach keeps the project manageable.

Why does PAM matter?

Once inside, attackers usually move forward by taking over admin accounts. PAM makes this harder and traceable by vaulting those credentials, requiring approval for their use and recording sessions.

What is the difference between PAM and IGA?

IGA manages the lifecycle and periodic reviews of all user access. PAM controls and records the moment high-privilege accounts are used. The two complement each other.

Can we manage supplier access with PAM?

Yes. Suppliers can connect through PAM without seeing passwords, using approved, time-limited sessions. Because every session is recorded, it can be reviewed later.

Are Nokta Guard products developed locally?

Yes. Nokta Guard products are developed in Türkiye by our own R&D team. We share up-to-date information on scope and status during a demo call.

Can I buy Nokta Guard PAM today?

Nokta Guard PAM is currently in development. You can submit an early access or demo request and we will contact you when appropriate.

Will you release products in other areas?

We shape our product roadmap around needs we see in the field. We do not commit to dates or scope for products that have not been announced.

Is Nokta Guard PAM really agentless?

Yes, Nokta Guard PAM is being designed with an agentless architecture. No software is installed on target systems; access is brokered through a central access point using standard management protocols.

Is Nokta Guard PAM certified?

The product is in development and we make no product certification claims at this stage. If certification matters for you, we can discuss it separately during a demo.

How can I join early access?

Send your early access or demo request through the contact form or info@noktaguard.com. After learning about your environment and expectations, we assess fit together.

Will OT monitoring affect production?

OT security monitoring solutions usually listen passively via a SPAN port or TAP and do not interfere with control traffic. We decide together with the operations team whether any active query features should be used.

What is the difference between CSPM and CNAPP?

CSPM detects misconfigurations and compliance gaps in cloud accounts. CNAPP is a broader approach that combines CSPM with workload protection (CWPP), entitlement analysis (CIEM) and development-time scanning in a single platform.

Can you assess our cloud before we buy a product?

Yes. Our Cloud Security Testing service identifies configuration and permission weaknesses in your AWS, Azure and GCP environments, and we clarify product needs based on those findings.

Are the cloud provider's native tools enough?

Native tools are a good start for their own platform. If you use multiple clouds or need workload protection, a third-party platform can provide a single view.

Does CNAPP require agents?

Many solutions scan agentlessly through cloud APIs and disk snapshots. Some capabilities, such as runtime protection, may still require an agent or sensor on the workload.

Will OT security monitoring affect production?

Sensors working through passive listening do not interfere with control traffic and are placed so as not to affect production. Active query features should only be used in a controlled way with the operations team's approval.

Why are IT security tools not enough in OT?

IT tools often do not understand industrial protocols, and active scans can affect sensitive control devices. OT monitoring solutions recognise these protocols and can evaluate what a command sent to a PLC actually means.

What is the difference between SSE and SASE?

SSE covers security services such as SWG, CASB and ZTNA. SASE (Secure Access Service Edge) adds networking components such as SD-WAN to SSE, unifying networking and security in a single architecture.

How does a CASB work?

A CASB works in two main modes: in API mode it connects directly to the SaaS application to audit stored data and settings, and in inline (proxy) mode it applies real-time policy to traffic between user and application. Many organisations use both.

Does ZTNA replace VPN?

ZTNA reduces VPN's broad-access risk by granting users access only to authorised applications rather than the whole network. It can replace VPN in many scenarios, though some legacy applications need a migration plan.

What is the difference between SIEM and SOAR?

A SIEM collects and correlates logs from many sources to generate alerts. A SOAR platform orchestrates the response to those alerts with playbooks and automates repetitive steps. Many organisations mature their SIEM first and then add SOAR.

Can you monitor these platforms for us?

Our SOC and MDR services are designed to cover monitoring and response needs. If you prefer to run the platform yourself, we support your team through deployment and handover.

Does a vulnerability scanner replace a penetration test?

No. A scanner detects known vulnerabilities automatically and regularly, while a penetration test shows real impact by having an expert chain weaknesses together. The two should be used together.

What is the difference between NDR and IDS?

Traditional IDS relies mostly on known attack signatures. NDR adds machine learning and behaviour analytics to detect unusual network activity and support response.