Question 1

How confidential are your engagements?

Accepted Answer

Extremely. Engagements are known only to a strictly limited group of stakeholders that you define. We operate under mutual NDAs, use out-of-band communication channels agreed at kickoff, and never reference client names publicly. For incident investigations, even internal teams outside the stakeholder group are not made aware of our presence.

Question 2

Can you test production environments that cannot tolerate downtime?

Accepted Answer

Yes. A significant share of our work is in ICS, critical infrastructure, and telecom environments where availability is non-negotiable. We agree on safe testing envelopes up front, use passive and low-impact techniques where required, and stage any potentially disruptive verification in mirrored or maintenance windows you approve.

Question 3

What is an unannounced assessment and why would we want one?

Accepted Answer

In long-term engagements, we can run assessments your operational teams are not told about in advance. This measures how your controls and people actually respond — including cases where internal personnel intentionally or unintentionally interfere with detection and response. Only the agreed stakeholder group knows the assessment window.

Question 4

What do we receive at the end of a penetration test?

Accepted Answer

A technical report with every confirmed vulnerability, reproduction steps, and evidence; an executive summary framing findings against your unacceptable business events; and a prioritized remediation plan. We also offer a retest window to verify fixes.

Question 5

How is attack-cost assessment different from a regular pentest?

Accepted Answer

A pentest maximizes the number of vulnerabilities found in a timeframe. An attack-cost assessment starts from a list of unacceptable business events you define, then estimates the realistic cost, effort, and skill an external attacker needs to achieve each one — giving you a financial measure of how hard your organization is to compromise.

Question 6

Can you assess hardware and embedded systems, not just software?

Accepted Answer

Yes. Our dedicated laboratory continuously evaluates the security of hardware, embedded systems, and software products — including onboard vehicle electronics and industrial controllers — to find vulnerabilities before they can be exploited in the field.

Question 7

How do incident investigations minimize operational impact?

Accepted Answer

Our specialists immerse into your digital environment — infrastructure, systems, user activity, and security events — using techniques chosen to avoid disrupting operations or alerting parties who may be involved. The goal is to uncover the root cause and collect reliable, defensible evidence quietly.

Frequently asked questions