What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

We don't know which test we need. Where should we start?

In a short initial call we review your systems, regulatory obligations and priorities. Based on that, we recommend whether an external network, web application, internal network or mobile application test should come first. Filling in our scoping form speeds this up.

What is a retest and why does it matter?

A retest is the re-examination of penetration test findings after they have been remediated. It shows whether each fix actually works, and closed findings are documented in a separate report. Many audits also expect proof that findings have been resolved.

What is the advantage of getting penetration testing and digital forensics from the same company?

After a security incident you often need to investigate how it happened and also test whether similar weaknesses exist elsewhere. Working with one team means findings move between the two without getting lost. Each engagement still runs under its own methodology and report.

How can I reach you for an urgent incident or evidence examination?

For urgent matters, call us directly on +90 216 606 16 22. If devices may hold evidence, call us before switching them off, turning them on or continuing to use them. We carry out an initial assessment by phone and plan the next steps with you.

How do I know which regulations apply to my organization?

Your licence, authorization and the type of data you process are decisive. Being a bank, payment institution or brokerage firm, or processing card data, each triggers different obligations. In an initial call we review your activities together and list the relevant regulations.

Can one penetration test cover several regulations?

Where scopes overlap, a single test plan can be designed to meet several requirements. Each regulation's scope, frequency and reporting expectations still need to be checked separately. We build the test plan with that mapping in place.

What does a compliance-oriented penetration test report contain?

An executive summary, scope and methodology, findings ranked by risk, evidence and remediation guidance are the core sections. If the regulation prescribes a report format or submission deadline, we structure the report accordingly.

Is penetration testing legally required in Turkey?

There is no general requirement for all companies. Sector regulations such as those of BDDK, the Capital Markets Board and the Central Bank, however, require covered institutions to have penetration tests performed at least once a year. Under frameworks such as KVKK and ISO 27001, penetration testing serves as evidence of appropriate security measures.

Do these regulation pages replace legal advice?

No. They are informational and based on official texts. For a definitive reading of your obligations, consult your legal and compliance teams.

What happens to the test plan if a regulation changes?

We check the current text of the relevant regulation during scoping. If a new version or amendment has been published, we adapt the test plan and report format accordingly.

How often does BDDK require penetration testing?

The Regulation on Banks' Information Systems and Electronic Banking Services requires penetration testing at least once a year. Additional testing after significant system changes should also be considered as part of risk management.

Can a bank's own team perform the BDDK penetration test?

The regulation requires testing by independent teams with no role in the design, development, implementation or operation of IT-based services. An internal team or an external provider meeting this condition may be chosen; the bank makes that assessment.

Which systems should a BDDK penetration test cover?

Scope is based on the bank's information systems inventory and risk assessment. Internet-facing services, the internal network, mobile and internet banking applications and critical servers are typically included.

How long does a BDDK penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping. Reporting and retesting are added on top.

Who must comply with the Information and Communication Security Guide?

The Guide was prepared under Presidential Circular No. 2019/12 for public institutions and critical infrastructure operators. We recommend confirming whether your organization is in scope based on the relevant legislation and announcements of the competent authority.

How does a Guide compliance audit differ from a penetration test?

A compliance audit assesses, as a whole, whether the Guide's measures are implemented. A penetration test demonstrates in practice how effective those measures are against attacks and can be used as audit evidence.

How often should penetration tests be performed under the Guide?

Implementation of the Guide is audited at least once a year, and auditors may ask how often penetration tests are performed. We determine frequency with you based on asset criticality and the relevant measures.

Which version of the Guide is current?

Version 1.1, published by the Cybersecurity Presidency, updates the original version to reflect the transfer of responsibilities. We base the test plan on the version in force.

Does ICTA require operators to perform penetration testing?

The Network and Information Security Regulation does not name penetration testing explicitly. Obligations such as the annual risk assessment and pre-deployment security testing can, however, be concretely supported by penetration testing.

Which operators must take additional security measures?

Operators exceeding the annual net sales threshold set by an ICTA Board decision, and GMPCS operators with subscribers, are subject to additional measures. We rely on ICTA's decisions in force for the current threshold and your status.

Does penetration testing help with ISO 27001 certification?

Penetration testing is strong evidence of the effectiveness of controls such as technical vulnerability management. ISO/IEC 27001 certificates themselves are issued by accredited certification bodies.

Which companies need EMRA penetration testing?

The Cybersecurity Competency Model Regulation covers licence holders such as electricity and natural gas distribution and transmission companies, generation companies, storage operators and refineries. We check which obligations apply to your licence at the proposal stage.

Will ICS penetration testing stop generation or distribution?

Testing is planned not to disrupt operations. Active tests are scheduled for maintenance windows or test environments, and passive methods take priority on live systems.

Who can perform EMRA penetration testing?

The procedures set competence requirements for testing personnel, such as ICS training and specific certifications. We clarify with you at the proposal stage how these requirements will be met.

Where is the EMRA penetration test report submitted?

The organization retains the report and provides it to EMRA on request. A board-approved action plan is prepared to remediate the findings.

Can Nokta Guard's report be used to apply for the Trust Stamp?

No. The security test required for the application must be performed by TSE-approved class A or B penetration testing firms. Nokta Guard's readiness test is an independent pre-assessment to help you close gaps before the official test.

How often is the Trust Stamp test required?

Under TOBB's criteria, the test must be done no more than three months before the application and at least once every calendar year. We recommend confirming the current conditions with TOBB.

Is the readiness test the same as a PCI DSS test?

No. The readiness test focuses on ASVS criteria for low and medium-volume sites. High-volume sites need PCI DSS compliance; see our PCI DSS Penetration Testing page.

Does ISO 27001 require penetration testing?

No, ISO/IEC 27001:2022 does not mandate penetration testing by name. When controls such as Annex A 8.8 technical vulnerability management are selected, however, penetration testing is one of the most concrete ways to demonstrate their effectiveness.

How is a penetration test report used in an ISO 27001 audit?

The report shows that vulnerabilities were identified, evaluated by risk and remediated. Presented together with retest records, it shows the control cycle is complete.