What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

How often should penetration testing be done for ISO 27001?

The standard does not prescribe a frequency; it follows your risk assessment. As a starting point, we suggest testing at least annually and after significant changes.

What changed between ISO 27001:2013 and 2022?

The 2022 edition reorganized Annex A into 93 controls across four themes. Technical vulnerability management is control 8.8 and security testing in development and acceptance is 8.29.

Does KVKK make penetration testing mandatory?

The law does not name a specific test or frequency; it requires technical and administrative measures that ensure an appropriate level of security. The Authority's Personal Data Security Guide lists regular vulnerability scanning and penetration testing among the recommended technical measures.

How often should penetration tests be performed for KVKK?

The Guide says 'regularly' without specifying an interval. We recommend basing frequency on the nature of your data, system changes and your risk assessment. As a starting point, we suggest testing at least annually and after significant changes.

Is a penetration test report useful in a KVKK review?

Regular tests and remediated findings are among the records that show technical measures were taken. How a report is assessed in a review is at the discretion of the competent authority.

Which systems should a KVKK penetration test include?

Systems that collect, process or store personal data come first: customer portals, mobile apps, APIs, databases and the internal network components that access them.

How often does PCI DSS require penetration testing?

Under PCI DSS v4.0.1 Requirements 11.4.2 and 11.4.3, internal and external penetration testing is performed at least once every 12 months and after any significant infrastructure or application change. Segmentation testing is required at least every 12 months, or every six months for service providers.

Does a QSA have to perform the PCI DSS penetration test?

No. The standard requires testing by a qualified internal resource or qualified external third party with organizational independence, and does not require the tester to be a QSA or ASV.

Is an ASV scan the same as a penetration test?

No. An ASV scan (11.3.2) is an automated vulnerability scan of internet-facing systems performed at least quarterly by a PCI SSC Approved Scanning Vendor. A penetration test (11.4) assesses whether vulnerabilities can actually be exploited. Nokta Guard is not an ASV.

What is segmentation testing?

Segmentation testing verifies that the firewalls and access controls separating the cardholder data environment from other networks actually work. It is required whenever segmentation is used to reduce PCI DSS scope.

Does SEDDK require insurers to perform penetration testing?

The Internal Systems Regulation expects internal controls covering information systems to be established and monitored. Penetration testing frequency and scope are determined by SEDDK rules and the company's risk assessment; we check current expectations with you at the proposal stage.

Which systems should insurers test?

Customer and agency portals, policy and claims systems, mobile apps, API integrations and the internal network are usually priorities. We define scope based on your risk assessment.

Can the penetration test report be used in internal audit?

Yes. We map findings to the relevant controls so your internal control and internal audit teams can track them directly.

Who does Turkey's Cybersecurity Law No. 7545 cover?

The law covers public institutions, public professional organizations, natural and legal persons and unincorporated organizations operating in cyberspace. Additional obligations apply to critical infrastructure operators.

Does the Cybersecurity Law make penetration testing mandatory?

The law does not set a specific penetration testing frequency for everyone in scope. Its obligations to take security measures and report vulnerabilities make regular technical testing necessary in practice; details are expected to be clarified by secondary regulations.

Who are vulnerabilities reported to under the law?

The law requires detected vulnerabilities and cyber incidents to be reported to the Cybersecurity Presidency without delay. Procedures and timelines are set by secondary regulations.

What should I check when procuring cybersecurity services?

The law requires public institutions and critical infrastructure to procure cybersecurity products and services from authorized and certified persons. We assess with you at the proposal stage how this applies to you in light of the secondary regulations.

When must the CMB penetration test report be submitted?

Under VII-128.10, the report must be sent to the Board within one month of test completion and in any case by 31 January of the following year. We recommend planning the test with that deadline in mind.

Are crypto asset service providers subject to CMB penetration testing?

Yes. Communiqué VII-128.10 also covers crypto asset service providers. Separate compliance dates apply to some articles; we check the current status with you at the proposal stage.

What changed from VII-128.9 to VII-128.10?

VII-128.10 replaced the 2018 Communiqué VII-128.9 and brought crypto asset service providers into scope. Annual testing and reporting to the Board continue, with a 31 January deadline of the following year for the report.

Who can perform the CMB penetration test?

The Communiqué requires testing by persons with no role in meeting information security requirements who hold a national or international penetration testing certification. We clarify how these conditions will be met at the proposal stage.

How often must payment institutions run penetration tests?

The CBRT Communiqué requires payment and e-money institutions to have their information systems penetration tested at least once a year. Testing must be based on scenarios covering internal and external threats.

Is CBRT penetration testing the same as the independent information systems audit?

No. The independent information systems audit is performed by audit firms authorized under the Communiqué. Penetration testing is a separate technical exercise that exposes vulnerabilities from an attacker's perspective.

How are penetration test results reported to the CBRT?

The Communiqué requires results and the remediation status of critical vulnerabilities to be reported to the Central Bank at least annually, in the manner the Bank deems appropriate. We structure our report to support that submission.

Which systems should a payment institution penetration test include?

Web and mobile payment channels, APIs, the internal network and critical servers are typically included. We define the exact scope from your system inventory and risk assessment.

My industry is not listed. What should I do?

We also provide penetration testing and digital forensics to industries not listed here. In an initial call we review your systems and applicable regulations and propose a suitable scope.

Are the industry packages fixed or customizable?

The packages are a starting point. We tailor the scope to your systems, risk priorities and budget.

Can I learn more about your industry experience?

We share our methodology and sample report structure in an initial meeting. We do not disclose client information because of our confidentiality obligations.

When should an e-commerce site be penetration tested?

We recommend testing at least annually and after significant changes to payment flows, membership or infrastructure. If your cardholder data environment is in PCI DSS scope, the standard's 12-month and post-change testing requirements apply.

Do we still need testing if a payment provider handles payments?

Even if card data is not processed directly by you, the site that loads the payment page and your integrations can still be attacked. We recommend confirming your PCI DSS scope with your payment provider.