Frequently Asked Questions
This page answers the most common questions about Nokta Guard's penetration testing and digital forensics services, project process, confidentiality, pricing and reporting. Questions are grouped under six headings, and each answer is written to stand on its own.
All
What is the difference between a sandbox and antivirus?
Antivirus mostly evaluates a file against known signatures. A sandbox runs the file in isolation and observes what it does, which helps detect malware that has not been seen before.
Is deception technology the same as a honeypot?
A honeypot is one of the building blocks of deception technology. Modern deception platforms add broader capabilities such as planting fake credentials and shortcuts on endpoints, central management and SIEM integration.
Do decoys affect real users?
Decoys are designed so they are not used in normal workflows, so they do not affect users. Any access to a decoy is treated as an incident that needs investigation.
What is an immutable backup?
An immutable backup is a copy that cannot be deleted or overwritten during its retention period, even by someone with administrator rights. It makes it much harder for ransomware operators to destroy backups.
We already have backups. Are we still at risk?
If backups are managed with the same domain accounts or reachable from the production network, attackers can delete or encrypt them. Untested restores are a separate risk.
How often should restore tests be run?
Frequency depends on system criticality and regulatory requirements. For critical systems we recommend regular, documented tests to confirm that recovery targets are met.