What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Do we need NDR if we have EDR?

EDR only sees devices with an agent installed. NDR can monitor all communication on the network, including network devices, IoT and unmanaged devices. The two complement each other.

Does NDR work on encrypted traffic?

Many NDR solutions can detect suspicious patterns from connection metadata and TLS handshake attributes without decrypting traffic. Content visibility, however, remains limited.

Is phishing simulation used to punish employees?

No. The goal is to measure risky behaviour and reduce it through targeted training, not to punish. We recommend using results for organisational improvement rather than individual blame.

Should we buy a platform or a service?

A platform can suit you if you have an internal team to run campaigns regularly. If you prefer to leave scenario design, sending and reporting to specialists, a service model is a better fit.

Will simulation emails be caught by spam filters?

They can be. During setup we configure the necessary exceptions in mail infrastructure and email security products without making the test meaningless.

What is the difference between SIEM and log management?

Log management collects, stores and makes records searchable. SIEM adds correlation, rule-based alerting and behaviour analytics on top, with a focus on detecting security incidents.

How is a SIEM licence sized?

Depending on the product, licensing may be based on events per second (EPS), daily data volume or number of assets. To size correctly, we first identify critical log sources and estimated volume in the needs assessment.

We deployed a SIEM but get too many alerts. What now?

This usually comes from untuned rules. The rule set needs tuning for your organisation, reducing noise and prioritising critical scenarios.

Do we need a SIEM before SOAR?

Not strictly, but SOAR is usually fed by alerts from a SIEM and other security tools. A SOAR deployed before alert sources are mature may end up simply automating noise.

What is a playbook?

A playbook is a workflow defining the steps for a given incident type. For a reported suspicious email, for example, it might analyse attachments, look up links and remove the message from all mailboxes if it is malicious.

What if automation takes the wrong action?

To reduce this risk, high-impact actions such as isolating a device or locking an account can require analyst approval. Playbooks are validated in a test environment before going live.

What is an IOC?

An indicator of compromise (IOC) is a technical artefact associated with an attack or compromise. Malicious IP addresses, domains, file hashes and email addresses are typical examples.

How is a TIP different from a threat intelligence service?

A TIP is a software platform that manages intelligence data. A threat intelligence service is analysts researching, interpreting and reporting on threats relevant to you. The platform processes data; the service adds context and judgement.

Why does authenticated scanning matter?

Scans run with privileged credentials can read installed software and patch levels directly, so they identify missing patches more accurately. Unauthenticated scans show what an attacker sees from outside.

Will scanning affect production systems?

Aggressive scans can cause performance issues on sensitive or legacy systems. We agree scan profiles and time windows with system owners, and in OT environments we consider active scanning only with the operations team's approval.

What is the difference between antivirus and EDR?

Traditional antivirus mostly blocks known malware using signatures. EDR continuously records process, network and file behaviour on the endpoint so it can also detect unknown techniques, support investigation and isolate the device.

Is one product enough against ransomware?

No. Prevention, detection and recovery layers need to work together. Our Ransomware Risk Analysis service shows which layer is missing in your environment.

Will DLP slow our users down?

We aim to roll out policies without disrupting work by classifying data first and running a monitor-only phase. The actual impact depends on the product and policy scope.

How long does a DLP deployment take?

It depends on the number of channels, the number of users and the maturity of data classification. Deployments usually start with an observation period in monitor mode, and policies are tightened in phases.

Does DLP help with data protection compliance?

DLP can be considered one of the technical measures against unauthorised transfer of personal data. Compliance, however, needs to be addressed holistically together with data inventory, policies and other organisational and technical measures.

Can DLP inspect encrypted files?

DLP usually cannot inspect the content of files encrypted by users. For this case, controls such as restricting or warning on encrypted file transfers are designed into policy.

Isn't our cloud email provider's protection enough?

Built-in protections in cloud email services provide an important baseline. Whether an additional solution is needed should be assessed through a PoC, based on the attacks you face and current detection performance.

What are SPF, DKIM and DMARC?

SPF defines which servers may send email for your domain, and DKIM uses a digital signature to verify a message has not been altered. DMARC is the policy that tells receivers how to handle messages failing these checks and provides reporting.

Can technology alone stop BEC attacks?

BEC messages without malicious attachments or links can pass technical controls. They should therefore be addressed together with process controls such as payment approvals and employee awareness.

What is the difference between EDR and XDR?

EDR focuses only on data from endpoints such as workstations and servers. XDR correlates endpoint data with telemetry from email, network, identity and cloud to provide a single detection and response platform.

Do we still need antivirus with EDR?

Most modern EDR solutions include a next-generation antivirus (NGAV) prevention layer. In that case a separate antivirus is usually unnecessary, but this should be confirmed against the chosen product's scope.

Who will monitor EDR alerts?

EDR's value depends on alerts being investigated in time. If your internal team is stretched, our MDR service is designed to fill that gap.

How is MFT different from cloud file sharing?

General cloud sharing services focus on ease of use. MFT adds control-focused capabilities such as enterprise authorisation, detailed audit logs, system-to-system automation and partner management.

Why are file transfer servers risky?

They are internet-facing and hold sensitive data, which makes them attractive targets. Delayed patching and exposed management interfaces increase the risk.

Should we replace our existing FTP server?

Plain FTP sends credentials and files in clear text. We recommend at least moving to encrypted protocols and evaluating an MFT solution where needed.