Question 1

How long does a web application penetration test typically take?

Accepted Answer

Scope determines duration. A focused assessment of a single web application usually takes between three and five days of active testing, plus time for report writing. More complex applications with extensive functionality or multiple APIs take longer. We scope precisely before any engagement so you know what to expect.

Question 2

What does your report look like, and who is it written for?

Accepted Answer

Every report has two parts. The executive summary is written for non-technical stakeholders: it explains what was found, the business risk, and what to do about it in plain language. The technical section is written for your developers and security team, with full reproduction steps, evidence, CVSS ratings, and specific remediation guidance per finding.

Question 3

Do you do internal network or Active Directory testing?

Accepted Answer

Currently, no. Our focus is web application testing, external infrastructure testing, phishing simulations, security awareness training, and security consulting. We're selective about what we offer so that what we do offer is done well.

Question 4

How do you handle confidential information during an engagement?

Accepted Answer

We sign a Non-Disclosure Agreement before any work begins. Credentials, findings, and client data are handled securely and never stored longer than necessary. At the end of an engagement, we can confirm deletion of any sensitive material you shared with us.

Question 5

What if we remediate the findings? Can you verify the fixes?

Accepted Answer

Yes. Optional retesting is offered at the end of every engagement. Once you've addressed the findings, we revisit the specific issues, verify the fixes held, and issue a letter of attestation confirming remediation status. This is often useful when presenting results to clients or auditors.

Question 6

Do you work with companies outside the Balkans?

Accepted Answer

For remote engagements (web application testing, external infrastructure testing, phishing simulations, and online consulting), yes, we work with clients across Europe. On-site security awareness training is primarily conducted within the Balkans region.

Question 7

How do we get started?

Accepted Answer

Send us a message through the contact form or email us directly. We'll have an initial conversation to understand your environment and objectives, then provide a clear scope proposal with timeline and pricing. There's no obligation until you accept the proposal.

Question 8

Do you work with startups or small teams without a security budget?

Accepted Answer

Yes. Most of our clients are startups, small businesses, and software teams without a dedicated internal security function. We scope engagements to fit your stage and actual needs, not a generic enterprise package. If you're unsure what level of testing makes sense, tell us about your application and we'll give you an honest recommendation.

Question 9

We're not sure what kind of assessment we need. Can you help us figure that out?

Accepted Answer

Absolutely. The initial conversation is specifically for this. Tell us about your application, infrastructure, and any specific concerns you have, and we'll recommend the most appropriate starting point. We won't push a larger scope than your situation warrants.

Question 10

Do you require written authorisation before testing?

Accepted Answer

Yes, without exception. Before any testing begins, we require explicit written authorisation from the party responsible for the systems being assessed. This includes a clear, agreed scope documenting what is in and out of bounds. We will not proceed with testing of any kind without this documentation in place. This protects both parties and is standard practice for any legitimate security assessment.

Straight answers to common questions.

Frequently asked questions.

Understand your real risk
before someone else does.

Straight answers to common questions.

Frequently asked questions.

Understand your real riskbefore someone else does.

Understand your real risk
before someone else does.