// frequently asked questions

Questions, answered straight.

The things clients ask before starting an engagement. Anything missing — ask directly.

How long does a penetration test take?
Duration depends on the asset count, roles, workflows, access and reporting needs. You receive an estimate after scoping, and testing dates, dependencies and the retest window are agreed in writing before work starts.
Do you sign NDAs?
Yes. A mutual NDA can be signed before any technical detail is shared. Confidential handling of client data is standard on every engagement, not an add-on.
What do we receive at the end?
Two deliverables: an executive summary written for leadership, and a technical annex with every finding, evidence, reproduction steps, severity, and remediation guidance — plus a live debrief call and a free retest of fixed issues within the agreed window.
Can you test production systems safely?
Production testing can be considered when the owner authorises the risk, test window, rate limits, data handling and stop conditions in writing. No test is risk-free; destructive techniques require separate explicit approval and a suitable environment.
Which standards do you test against?
Web and API testing is mapped to OWASP WSTG and the OWASP API Security Top 10; infrastructure work follows PTES and NIST SP 800-115; compliance gap work covers ISO 27001, SOC 2, PCI DSS, and NIST CSF.
Do you work with international clients?
Remote engagements and possible on-site work are scoped by location, availability and access requirements. Working hours, time-zone overlap and travel arrangements are confirmed in writing; no standing out-of-hours coverage is implied.
How is pricing structured?
Fixed-price per engagement, agreed after scoping. No hourly surprises. Retests of fixed findings within the agreed window are included.
What makes ABZSECURE different from a big firm?
The engagement defines delivery roles, evidence requirements and communication owners in writing. Findings connect technical validation, business impact, limitations and practical remediation. Relevant qualifications are confirmed during scoping.
Ask your question →

Questions to ask ANY penetration tester before you hire them

Use these to evaluate any provider, including ABZSECURE. The answers should be specific to the people and scope proposed.

  1. 1Who will scope, test and review the work, and what experience is relevant to this engagement?
  2. 2Is this manual testing, or mostly an automated scan with a report wrapped around it?
  3. 3Can I see a sample report showing real exploit evidence, not just a vulnerability list?
  4. 4Is a retest of fixed findings included, or billed as an extra?
  5. 5What standards do you test against (OWASP, PTES, NIST)?
  6. 6How do you handle sensitive data and rules of engagement?