What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Do we need full compliance with the CIS Benchmarks?

No. The goal is informed risk management, not blind compliance. Controls that are not applied are documented with a rationale and any compensating measure.

Is hardening a one-time project?

No. New systems, updates and configuration changes cause drift over time. The standard needs to be built into templates and measured regularly.

Is training delivered online or in person?

Both formats are available. We agree on the best format based on audience size, locations and the type of training.

How do you measure the impact of training?

We measure progress with pre- and post-training assessments, phishing simulation results and suspicious email reporting rates.

Where should we start?

A phishing simulation to measure the current state, followed by awareness training based on the results, is usually an effective start. For leadership readiness, a cyber crisis exercise is recommended.

Are phishing simulations legal?

Simulations aimed at an organization's own employees, approved by management and with staff informed in advance, are a common security practice. Data protection principles such as transparency and proportionality must be followed, and we recommend reviewing the details with your legal team.

Should employees be told the simulation date in advance?

Employees are generally informed that phishing simulations will take place, but not the dates or content of campaigns. This keeps the process transparent while still allowing realistic measurement.

Are the names of employees who click reported?

Default reports contain aggregated results by department and scenario. Individual-level data is shared only for pre-agreed purposes such as targeted training, and only with a limited group.

How often should simulations be run?

Several campaigns a year are recommended to track behavior change; many organizations run them quarterly or every six months. Varying the scenarios each time is important.

How often should awareness training be delivered?

At least one comprehensive session a year is recommended, with short refreshers and phishing simulations in between. Training new hires during onboarding is also important.

How long does the training take?

A core awareness session typically lasts one to two hours. The program can be extended with role-based modules depending on audience size.

Does the training cover data protection?

The training covers technical and behavioral topics such as safe handling of personal data and preventing data leaks. For detailed training on legal obligations under data protection law, we recommend working with your legal advisor.

How can we track progress after training?

Periodic phishing simulations show changes in click and reporting rates, giving you a concrete way to track the training's impact.

Does a tabletop exercise affect our systems?

No. A tabletop exercise is discussion-based and no systems are touched. To test technical response skills in a live environment, approaches such as red teaming are used instead.

How long does the exercise take?

Typically between half a day and a full day, depending on scenario scope and number of participants. Preparation and reporting are planned in addition.

Can we run an exercise without an incident response plan?

Yes. In that case the exercise surfaces existing assumptions about who does what in a crisis and becomes a strong starting point for writing a plan.

How often should exercises be repeated?

At least once a year, and after major changes in leadership, organization or infrastructure. Choosing a different scenario each time exposes different weaknesses.

Are courses tailored to our organization?

Yes. Technical courses are planned as private sessions for your organization, built around the technologies your team uses and its needs.

What level do participants need to be?

Courses can be prepared at beginner, intermediate and advanced levels. Participant levels are assessed at the start and content is adjusted accordingly.

Do participants receive a certificate?

Participants who complete the course receive a Nokta Guard certificate of attendance. It is not a substitute for an international certification exam.

Do we need to set up anything for the labs?

Participants usually need only a laptop and an internet connection. Any prerequisites are shared before the course.

What is the difference between offensive and defensive security?

Offensive security focuses on finding weaknesses from an attacker's perspective, while defensive security covers preventing, detecting and responding to attacks. The two are complementary: offensive findings help prioritize defensive investments.

Which test should we start with?

For most organizations the first step is a penetration test covering internet-facing systems and critical applications. As maturity grows, scenario-based work such as red or purple teaming adds more value. We define the right test together during scoping.

Is testing risky for production systems?

Every engagement runs under written authorization, a clear scope and agreed rules of engagement. Steps that could affect availability are discussed in advance and, where needed, performed in a maintenance window or a test environment.

Do we need permission from the cloud provider?

Major cloud providers allow customers to test many services in their own accounts without prior approval, but they define prohibited activities and rules. Some tests, such as DDoS simulations, may require separate notice or approval. We plan scope accordingly.

Is cloud security testing the same as a CSPM tool?

No. CSPM tools continuously and automatically check configurations. Cloud security testing is expert-led work that chains findings into real attack paths and validates them through exploitation.

What access do you need?

A read-only account is usually enough for the configuration review. For attack path scenarios we may request a low-privileged test identity defined in the scope.

Can a DDoS test take our systems down?

Yes, the risk exists, which is why tests run in a maintenance window with gradual ramp-up and an immediate stop procedure. For critical systems we recommend starting with low-intensity validation scenarios.

Do we have to notify our service providers?

Yes. A test run without informing your ISP, DDoS protection provider and cloud provider may be treated as a real attack and may breach your contracts. We plan notifications with you.

We already have DDoS protection. Do we still need testing?

Protection configurations, thresholds and application-layer rules vary by organization. Testing is how you verify that your protection works as expected for your own services.