What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can deleted data be recovered?

Whether deleted data can be examined depends on the device type, how the data was deleted, whether the device was used afterwards and whether it is encrypted. Where technically possible, deleted files and records can be examined, but the outcome cannot be guaranteed in advance. We share the likelihood with you during the initial assessment.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

Will OT penetration testing stop production?

Our goal is to avoid any impact on production. Most of the work is passive; active tests run only on approved targets within the times and limits you set. A stop procedure is defined in advance.

What is IEC 62443?

IEC 62443 is an international series of standards for the cybersecurity of industrial automation and control systems. It defines requirements for asset owners, system integrators and product suppliers, along with the zone/conduit model and security levels.

Does this test provide IEC 62443 certification?

No. A penetration test is not certification; findings are reported with reference to IEC 62443 concepts and serve as input to your compliance work.

Is testing performed on site?

Passive traffic analysis and controlled active testing are usually done on site or over a secure remote connection, depending on your facility's access rules.

How many devices do we need to send?

Hardware testing may involve opening or modifying the device, so we usually request more than one sample. The exact number depends on scope and methods.

Can the device be damaged during testing?

Some hardware techniques, such as removing a memory chip, can render a device inoperable. These steps are discussed in advance and performed only with your approval.

Is a firmware file alone enough?

Firmware can be analyzed on its own and yields valuable findings. Testing hardware interfaces and wireless communication, however, requires a physical device.

What is the difference between source code review and penetration testing?

A penetration test attacks the running application from the outside. Source code review examines the code itself and shows the root cause of vulnerabilities. Used together, they provide the broadest coverage.

Which programming languages do you review?

We can review common web, mobile and backend languages. The languages and frameworks in your project are confirmed during scoping. Supported languages include Java, C# / .NET, PHP, Python, JavaScript / TypeScript (Node.js), Go, Kotlin, Swift, C / C++ and other common languages.

How is the confidentiality of our code protected?

Code is received under a non-disclosure agreement over encrypted channels and reviewed only in environments accessible to the project team. At the end of the project it is deleted or returned as defined in the contract.

What is the difference between purple teaming and red teaming?

A red team operates unannounced and measures how defenses react to a realistic attack. A purple team works openly with the defenders, with the goal of improving detection capability step by step.

What infrastructure is needed?

Centralized log collection (SIEM) and an endpoint detection tool (EDR) make the exercise more productive. Without them, the exercise can also show which log sources and tools are needed.

We use a managed SOC provider. Can we still do purple teaming?

Yes. Your provider's team can join the sessions and validate its rules in your environment. It is a practical way to measure the detection coverage you are receiving.

How long does a red team engagement take?

Duration varies with the scope of each project; we confirm the timeline in the proposal after scoping. Moving stealthily like an adversary takes more time than a standard penetration test.

Are our employees and defenders informed?

To keep the exercise realistic, the defenders are not informed. A control group designated by management stays in contact with us throughout and can halt the operation if needed.

Is our organization ready for red teaming?

If basic penetration tests have not been completed and findings remain open, a red team will mostly rediscover known issues. In that case a penetration test or purple team exercise is usually a better first step.

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan uses automated tools to list known issues. A penetration test is performed manually by experts, proves exploitability and uncovers problems scanners miss, such as business logic flaws.

Will testing affect our systems?

Testing runs within agreed rules and time windows with service continuity in mind. Steps that could cause disruption are never performed without your approval.

What is a retest?

A retest checks whether reported vulnerabilities have been effectively fixed. Results are delivered as a separate report.

Can you test without API documentation?

Yes. We can derive endpoints from application traffic, but sharing an OpenAPI definition or Postman collection is recommended so undocumented endpoints are not missed.

Do you test GraphQL services?

Yes. Introspection, query depth and cost, batched queries and field-level authorisation are tested specifically for GraphQL.

Does a web application test cover the APIs?

The APIs a web application uses are reviewed during the web test. If you expose a larger API estate to partners or share it across several applications, a dedicated API test gives more complete results.

Is an external network test the same as a vulnerability scan?

No. A vulnerability scan lists known issues automatically. In an external penetration test, a specialist verifies findings, proves exploitability and shows how several weaknesses combine into an attack path.

Which IP addresses do you test from?

We confirm our source IP addresses in writing before testing starts, so your security team and service providers can recognise the traffic.

Do we need to notify our cloud provider?

Most major cloud providers do not require pre-approval for standard penetration tests on your own resources, but each provider's acceptable use rules differ. We check the relevant rules with you during scoping.

Can an internal network test be done remotely?

Yes, either over a VPN connection you provide or through a test machine you set up for us inside your network. If physical segmentation or wireless networks are also in scope, on-site work is planned.

What happens if you reach domain admin?

We report it immediately and stay within the agreed limits. The privilege is used only as far as needed to prove impact, and no permanent changes are left on systems.

Are accounts and files created during testing cleaned up?

Yes. Every account, file and configuration created during testing is logged and removed at the end; the list is included in the report.

Can a wireless test be done remotely?

No. A wireless network can only be tested within signal range, so the work is done on site.

Will our employees lose connectivity during testing?

Steps that could disconnect users are not performed by default. If a scenario requires one, we get your approval first and run it in a short, planned window.