Frequently Asked Questions

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Impedit, libero harum cum numquam repellendus autem recusandae voluptatem, asperiores iusto magni reprehenderit.

  • What is Pen Testing?

    Pen testing, or penetration testing, is the process of evaluating and testing the security of a computer system, network, or web application by simulating an attack from a malicious hacker. Penetration testers use a variety of techniques to identify vulnerabilities in the system, such as exploiting known weaknesses or attempting to bypass security controls. The goal of pen testing is to identify potential security weaknesses before they can be exploited by real attackers and to provide recommendations for mitigating those vulnerabilities. Pen testing is an essential component of any comprehensive security program and can help organizations improve their overall security posture.

  • Can I run Pen Tests on AWS Infrastructure?

    Yes, you can run a pen test on AWS. However, it is important to keep in mind that conducting pen testing on cloud infrastructure like AWS requires proper planning, coordination, and authorization from AWS. AWS has specific guidelines and requirements that must be followed to ensure the safety and availability of their services, and they have restrictions on certain types of testing that can be performed. Before conducting a pen test on AWS, it is recommended that you review the AWS Penetration Testing Rules of Engagement and follow the guidelines outlined in the AWS Penetration Testing whitepaper. In addition, you may need to obtain written permission from AWS before conducting any testing on their infrastructure. It is important to conduct pen testing on AWS to identify potential security vulnerabilities, but it should always be done in a safe and controlled manner to minimize any potential impact on AWS services and data.

  • What is a vulnerability assessment?

    A vulnerability assessment is the process of identifying and evaluating potential security vulnerabilities in computer systems, networks, and applications. It involves analysing the system for weaknesses that could be exploited by an attacker, such as outdated software, misconfigured settings, and weak passwords. Vulnerability assessments can be conducted manually or with the help of automated tools.

  • How long will it take to run a pen test?

    The length of time it takes to run a pen test can vary depending on a variety of factors, such as the size and complexity of the system being tested, the scope of the test, the testing methodology used, and the resources available.

    For example, a simple web application pen test may take only a few hours to complete, while a comprehensive network penetration test of a large organization may take several weeks to conduct.

    In general, a pen test should be given enough time to ensure that all potential vulnerabilities are identified and adequately tested, and to allow for thorough analysis and reporting of the results. Typically, a pen test can take anywhere from a few days to several weeks to complete.

    It is important to keep in mind that the length of time it takes to run a pen test should not compromise the safety or availability of the system being tested. It is important to plan the pen test carefully, coordinate with relevant stakeholders, and communicate the duration and scope of the test to ensure that it can be conducted in a safe and effective manner.

  • Does a pen tester need to visit my office?

    It depends on the type of pen testing being conducted.

    For network and web application penetration testing, it is often possible to conduct the testing remotely without the need for a physical visit to your office. In these cases, the pen tester can simulate an attack on your network or web application from a remote location, using various tools and techniques to identify vulnerabilities.

    However, for physical penetration testing or social engineering testing, a pen tester may need to visit your office or physical location to conduct the test. These types of tests involve attempting to gain unauthorized access to physical locations or information by posing as an employee or contractor, or by exploiting physical security weaknesses.

    In general, the need for a physical visit will depend on the scope of the testing and the specific requirements of your organization. The pen testing company you work with should be able to advise you on whether or not a physical visit is necessary for your particular situation.

  • Is it safe to get a pen test on my website?

    Yes, it is generally safe to get a pen test on your website. In fact, conducting regular pen testing on your website is an important part of maintaining good security practices and can help you identify potential vulnerabilities before they can be exploited by attackers. However, it is important to ensure that the pen testing is conducted by a reputable and experienced company with a proven track record of conducting pen tests in a safe and ethical manner. A poorly executed pen test can potentially cause damage to your website or result in unintended consequences, such as disrupting your website's availability or compromising sensitive data. It is also important to properly plan and coordinate the pen test with relevant stakeholders and to ensure that appropriate measures are in place to minimize the impact on your website and users. This may include setting up a test environment or notifying users in advance of the testing. Overall, if conducted properly by an experienced and reputable pen testing company, a pen test on your website can help identify potential vulnerabilities and improve the overall security of your website and your organization.

  • How often do I need to pen test?

    The frequency at which you should conduct pen testing depends on various factors, such as the size and complexity of your organization, the level of risk associated with your systems, and any applicable compliance or regulatory requirements. In general, it is recommended to conduct pen testing at least once a year or after any major changes or updates to your systems or applications. However, for high-risk systems or those that store or process sensitive data, more frequent testing may be necessary. It is also important to note that pen testing is not a one-time event, but rather an ongoing process. As new threats emerge and technology evolves, your systems may become vulnerable to new attack methods. Regular pen testing can help you stay ahead of these threats and ensure that your security measures are effective. In addition to regular pen testing, it is important to conduct ongoing vulnerability assessments and implement proactive security measures to help reduce the risk of attacks. This can include implementing security patches and updates, using strong authentication methods, and providing security training to employees. Ultimately, the frequency of pen testing should be based on a comprehensive risk assessment of your organization's systems and data, taking into account factors such as the likelihood and potential impact of a security breach.

  • What is my attack surface?

    Your attack surface refers to the sum of all the different points of entry that attackers could potentially use to gain unauthorized access to your organization's systems or data. This includes hardware, software, and human vulnerabilities that could be exploited. For example, your attack surface may include your network infrastructure, web applications, mobile devices, email systems, cloud services, and third-party vendors. It may also include weaknesses in your physical security, such as access control systems or surveillance cameras. Identifying and understanding your attack surface is an important step in developing a comprehensive security strategy. By knowing the potential vulnerabilities in your organization's systems, you can better prioritize security measures and allocate resources to areas that are most at risk. To identify your attack surface, you can start by conducting a comprehensive inventory of all your organization's hardware, software, and systems. You can then assess each item on the inventory for potential vulnerabilities and create a plan to mitigate those risks. Regular vulnerability assessments and pen testing can also help identify new vulnerabilities and reduce your attack surface over time.

  • When can I book a pen test?

    You can book a pen test at any time, although it is best to plan and schedule the testing in advance to ensure that it fits into your organization's schedule and to allow time for any necessary preparations. Before booking a pen test, it is important to have a clear understanding of your organization's security goals and objectives, as well as any compliance or regulatory requirements that may apply. You should also identify the scope of the testing, including which systems and applications will be tested and what types of attacks will be simulated. Once you have a clear plan in place, you can start looking for a reputable and experienced pen testing company to conduct the testing. It is important to choose a company that has a proven track record of conducting pen tests in a safe and ethical manner and that has experience working with organizations in your industry. When scheduling the pen test, it is important to work with the pen testing company to coordinate the timing and ensure that appropriate measures are in place to minimize the impact on your systems and users. This may include setting up a test environment or notifying users in advance of the testing. Overall, booking a pen test can be done at any time, but it is important to plan and prepare in advance to ensure that the testing is conducted in a safe and effective manner.

  • Do I really need to pen test my mobile apps?

    Yes, it is important to conduct regular pen testing on your mobile apps to identify and address any vulnerabilities that may be present. Mobile apps are becoming an increasingly popular target for cyber attackers, as they often contain sensitive user data, such as login credentials, payment information, and personal details. Pen testing can help identify potential security flaws in your mobile app, including vulnerabilities in the code, weak authentication mechanisms, and issues with data storage and transmission. This can help you address these issues before they can be exploited by attackers, helping to protect your users and your organization's reputation. In addition, many compliance standards and regulations require regular security testing for mobile apps, including the Payment Card Industry Data Security Standard (PCI DSS) and the General Data Protection Regulation (GDPR). Overall, pen testing is an important component of a comprehensive mobile app security strategy, helping to identify and address vulnerabilities and ensure that your users' data is protected.

Ask Questions

If you have any questions or concerns, get in touch using the form below.