What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

What is the difference between pre-campaign load testing and DDoS testing?

Stress testing measures your application's performance limit under real user load. DDoS testing checks, in a controlled way, how well your protection layers hold up under malicious attack traffic.

Will OT penetration testing affect production?

We plan testing not to disrupt operations. Passive methods take priority on live systems; active tests run in maintenance windows or test environments.

Which regulations apply to energy companies?

EMRA's Cybersecurity Competency Model Regulation and ICS Security Analysis and Testing Procedures are the main rules. Organizations designated as critical infrastructure also have obligations under Cybersecurity Law No. 7545.

Are IT and OT tested separately?

They are usually planned as separate phases, but the most critical scenario is moving from IT into OT. We therefore design segmentation testing as the step that links both phases.

How often should banks run penetration tests?

BDDK's information systems regulation requires banks to have independent teams perform penetration tests at least once a year. Additional testing after significant system changes should also be considered.

If we are subject to several regulations, is one test enough?

Where scopes overlap, a single test plan can be designed to meet several requirements. We address each regulation's reporting and submission expectations separately.

How is a mobile banking app tested?

We test the app following OWASP MASVS and MASTG, covering on-device data storage, communication security and the back-end APIs.

Do you act as a court-appointed expert?

No. Nokta Guard is not a court-appointed expert (bilirkişi); we provide expert opinion and technical consulting to the parties. We can review existing court expert reports technically and report our assessment.

How do you support cyber insurance claims?

We examine the point of entry, affected systems and timeline from available logs and images, as far as technically possible. We present findings in a clear report that can be used in the claim assessment.

Are public institutions required to perform penetration testing?

The Information and Communication Security Guide lists penetration testing among the methods for auditing measures, and implementation of the Guide is audited at least once a year. Frequency and scope depend on asset criticality.

Do you also perform Guide compliance audits?

Guide compliance audits and penetration tests are separate engagements; outsourced compliance audits are carried out by firms authorized under the program defined in the Audit Guide. We focus on penetration testing and technical validation.

Will testing disrupt citizen services?

We plan testing under rules that protect service continuity, outside working hours where needed. High-risk tests are carried out only with your prior approval.

Will testing a hospital network affect patient care?

On critical clinical systems we test only in approved time windows using controlled methods. Active testing of medical devices is carried out on test units or during maintenance where possible.

Is penetration testing mandatory for health data?

KVKK requires measures that ensure an appropriate level of security for all personal data, including special category data. The Authority's Personal Data Security Guide lists regular penetration testing among those measures.

How is medical device security assessed?

We assess each device's network position, exposed services and isolation from other systems. Firmware and hardware-level analysis is planned under IoT and hardware testing, depending on the device.

Is penetration testing mandatory for telecom operators?

ICTA's Network and Information Security Regulation does not name penetration testing explicitly, but obligations such as the annual risk assessment and pre-deployment testing of new systems can be concretely supported by it.

Is DDoS testing on a live network safe?

DDoS tests run with pre-approved scenarios, traffic limits and an immediate stop procedure. Testing is coordinated with your service providers and relevant teams.

Why test call center processes?

Transactions such as number porting or SIM swaps can be abused through social engineering. We test these processes with approved scenarios to expose gaps in identity verification.

Will penetration testing stop production?

We plan testing not to disrupt production. Passive methods take priority on live lines; active tests are run during planned downtime or in test environments.

Is penetration testing mandatory for manufacturers?

There is no general sector-specific requirement. Customer contracts, ISO 27001 certification and insurance expectations, however, frequently call for regular security testing.

How are supplier connections tested?

We assess remote access solutions, the scope of privileges and how that access reaches the OT network. The goal is to see how far an attacker could get if a supplier account were compromised.

How do we know which service is right for us?

In a short initial call we listen to your systems, current issues and regulatory obligations. We then recommend in writing which service should be prioritised and with what scope. The call carries no commitment.

Can we buy services individually or as a bundle?

You can engage us for a single service or combine several into one programme. For example, a penetration test followed by vulnerability management and employee awareness training can be scheduled within the same year. In combined programmes, findings are tracked across services.

Are services delivered remotely or on-site?

Testing of internet-facing systems and much of our consulting work can be done remotely. Internal network tests, social engineering scenarios and some forensic examinations may require on-site work or device handover. We agree on the approach during scoping.

How long does a digital forensic examination take?

It depends on the type of material, the volume of data and the scope of the examination. We share an estimated timeframe after the initial assessment.

Can your report be used in court?

Our reports are prepared using forensic methods and the chain of custody is documented. Whether and how a report is used in legal proceedings, and how much weight it carries, is at the discretion of the court or relevant authority.

Will the examination damage my device?

In standard examinations the contents of the device are not altered; we work on an image acquired with write protection. Advanced techniques that may permanently damage a device, such as chip-off, are applied only with your written consent.

Can deleted data always be recovered?

No, we never promise a guaranteed result. Recoverability depends on the device, the file system, how much time has passed and whether the data has been overwritten. We give you a realistic assessment after a preliminary review.

Can you review a forensic report submitted by the other party?

Yes. We technically assess an existing digital forensics report in terms of method and findings and, if requested, prepare an expert opinion.

What language is the report written in?

Reports are prepared in Turkish. An English version can be produced on request.