Question 1

How is a penetration test different from a vulnerability scan?

Accepted Answer

A scanner lists CVEs; a penetration test demonstrates impact. We chain findings the way a real attacker would, show you exactly what was reachable, and document reproduction steps. If a report is just scanner output with a new logo, it wasn't a pen test.

Question 2

How long does a pen test take?

Accepted Answer

Most engagements run 2-4 weeks: scoping in week one, hands-on testing for one to two weeks, then reporting and a debrief. Retest is scheduled after your team remediates.

Question 3

Will this satisfy SOC2, PCI, or customer contract requirements?

Accepted Answer

Yes. The report and attestation letter are written to hold up with auditors, customers, and cyber-insurance carriers. If you need the full framework work too, see our Compliance & Assessments service.

Question 4

How often should we test?

Accepted Answer

Annually at minimum, plus after major changes: new product surface, big infrastructure moves, M&A. Many customers and frameworks now expect an annual test as table stakes.

Question 5

Is testing safe to run against production?

Accepted Answer

We test production carefully: rules of engagement set safe windows, excluded systems, and escalation contacts before any testing starts. Denial-of-service testing is out of scope unless you specifically ask for it in an isolated environment.