What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Will my phone work after chip-off?

No. The procedure permanently damages the device, which is why it is used only when other methods fail and only with your written consent.

My phone fell in water. Can the data be recovered?

If the memory chip is undamaged, it is often possible. Do not charge it or try to dry or open it; contact us directly.

I don't know the screen lock. Can the data be retrieved?

It depends on the make, model and OS version. We give you a realistic assessment after a preliminary review.

Does chip-off work on every phone?

No. Many modern phones encrypt data with keys tied to the device, so raw data read from the chip may not be usable on its own. We assess suitability during the preliminary review.

Can every encrypted drive be opened?

No. With strong, correctly configured encryption, access without the key may not be technically possible. A preliminary review gives a realistic assessment.

We have the recovery key but the drive still won't open.

In that case the problem may lie with the drive or the file system rather than the encryption. The appropriate recovery method is decided after examination.

Is this legally problematic?

We only work where you have legal authority over the drive. We establish and document that authority when we take on the request.

Will hardening break our systems?

Settings applied without control can affect applications. That is why we test changes on pilot systems first and roll them out in phases after impact analysis.

Should hardening come before or after a penetration test?

Both are part of one cycle. A penetration test reveals the most critical paths, hardening closes them, and a follow-up test verifies the effect of the changes.

Which standards do you use?

We primarily reference the CIS Benchmarks, vendor security guidance and industry requirements. The control set is tailored to the regulations your organization is subject to.

What is Kerberoasting?

Kerberoasting is an attack technique in which any domain user requests Kerberos tickets for service accounts and cracks them offline to recover the service account password. Long, random passwords and managed service accounts significantly reduce this risk.

Does the AD assessment change our systems?

No. The assessment collects data with read access and makes no changes. Remediation is applied with your approval and in a planned way.

Why does LAPS matter?

When every device shares the same local administrator password, a password taken from one machine can be used for lateral movement across the network. LAPS reduces this risk by creating unique, regularly rotated passwords for each device.

How is an AD assessment different from a penetration test?

An internal penetration test demonstrates some AD weaknesses by exploiting them. An AD assessment systematically reviews the entire configuration and also reveals paths that were not tried during the test.

What is CSPM?

CSPM (Cloud Security Posture Management) is the approach and tool category that continuously checks cloud account configurations against security policies and best practices. The aim is to catch and fix misconfigurations as soon as they appear.

What access do you need to our cloud accounts?

A role with read-only permissions is enough for assessment and monitoring. We do not change your resources; fixes are applied by your team or with your approval in a planned way.

Can you cover multiple cloud providers?

Yes. We can assess AWS, Azure and Google Cloud accounts with the same approach and reporting format.

Aren't the cloud provider's own security tools enough?

Built-in provider tools are a good starting point. Validating findings, prioritizing them in business context and tracking them to closure still requires expert effort.

Can we go straight to DMARC reject?

It is not recommended. All legitimate senders must first be identified in monitoring mode; otherwise legitimate mail such as marketing or invoice emails may be blocked.

Isn't SPF alone enough?

No. SPF does not protect the visible From address and can break when mail is forwarded. Effective protection requires SPF and DKIM working together with DMARC.

How long does a DMARC rollout take?

Duration varies with the scope of each project; we confirm the timeline in the proposal after scoping. Domains with few senders move faster.

Should we protect domains that never send email?

Yes. Unused domains can also be abused for spoofing. Publishing SPF and DMARC records that reject all mail for those domains is recommended.

How often should firewall rules be reviewed?

At least once a year is recommended, and more often in environments with frequent changes, depending on rule base size. The standard you are subject to may set a specific interval.

Do you change our rules during the review?

No. The review produces analysis and recommendations. Changes are applied with your approval and in line with your change management process.

Can you review firewalls from different vendors?

Yes. The review is vendor-neutral; we work from the rule base and configuration exports of common enterprise firewalls.

Is this useful before a firewall migration?

Yes. Cleaning up unnecessary rules before migration keeps old clutter from moving to the new device and simplifies the project.

Do we need to buy new products for zero trust?

Not always. Your existing firewall, identity and endpoint solutions are often enough for the first steps. We define any missing components as vendor-neutral requirements.

Will segmentation disrupt our business processes?

It can if done without a plan. We first analyze traffic flows, validate rules in monitoring mode and plan the transition in phases.

When is architecture consulting needed?

Typical triggers are a new data center or cloud migration, mergers and acquisitions, the aftermath of a serious security incident, or a penetration test showing a flat network.

Will hardening break our applications?

Some settings can affect legacy or custom applications. That is why we assess each control against application dependencies and test on pilot systems first.