Question 1

Can the penetration test support ISO 27001 certification or a SOC 2 audit?

Accepted Answer

Yes. The scope, evidence, and final report can be structured to support ISO 27001 certification work, SOC 2 examinations, procurement reviews, and customer assurance requirements.

We discuss the relevant requirement during scoping so the assessment covers the expected systems and produces suitable evidence. Acceptance ultimately remains with the auditor or certification body, and the penetration test does not itself certify compliance.

Question 2

Do you provide vulnerability assessments and VAPT?

Accepted Answer

Yes. Engagements can be scoped and reported as vulnerability assessments or VAPT where procurement, assurance, or compliance processes require those terms.

Testing depth, validation activities, and deliverables are defined during scoping rather than treating penetration testing, vulnerability assessment, and VAPT as automatically identical engagements.

Question 3

Is the testing manual or automated?

Accepted Answer

The assessment is led by penetration testers and is primarily manual. Tooling supports discovery, coverage, and repeatable checks, but potential findings are investigated and validated manually within the context of the application or environment.

Automated scanner output is not presented as a penetration testing result without further review and validation.

Question 4

What penetration testing methodology do you follow?

Accepted Answer

Testing follows a risk-based methodology adapted to the target, its attack surface, and the objectives of the engagement.

Web and API assessments are informed by resources such as the OWASP Web Security Testing Guide, OWASP ASVS, OWASP Top 10, and OWASP API Security Top 10. Mobile testing may draw from OWASP MASVS and MASTG. Infrastructure assessments may reference NIST SP 800-115 and MITRE ATT&CK where relevant.

These resources support coverage and consistency but do not replace manual analysis, business-logic testing, or adjusting the assessment as vulnerabilities are found and additional functionality is explored.

Question 5

What do you need from us to begin?

Accepted Answer

To begin scoping, we usually need the application URL or the organization's primary domain, together with a short description of what you want assessed.

This allows us to understand the likely attack surface, identify initial scoping questions, and recommend an appropriate assessment approach. Once the engagement is authorized and the scope is defined, test accounts, API documentation, architecture information, credentials, and other technical material can be provided where required.

Question 6

Can testing be performed against a production environment?

Accepted Answer

Yes, where appropriate and authorized. Before active testing begins, we agree the testing constraints, sensitive workflows, excluded actions, communication channels, and escalation procedures.

Where production testing would introduce unnecessary operational risk, we can discuss an appropriate staging or pre-production environment instead.

Question 7

What does the report contain?

Accepted Answer

Findings include observed behavior, supporting evidence, affected components, prerequisites, limitations, confirmed impact where appropriate, and prioritized remediation guidance.

The report also provides an executive summary of the results and the technical detail needed by the teams responsible for remediation.

Question 8

Do you test both Android and iOS mobile applications?

Accepted Answer

Yes. Mobile application assessments can cover both Android and iOS, including client-side behavior, local data storage, transport protections, platform-specific security controls, and the APIs and backend services used by the app.

Question 9

Is retesting available?

Accepted Answer

Yes. We retest all discovered vulnerabilities after remediation, provide updated evidence, and document anything that remains unresolved.

Where a fix is incomplete, we explain what is still exposed and what should be addressed next.