Common questions
Straight answers before you reach out.
What exactly is VAPT?
Vulnerability Assessment & Penetration Testing. A vulnerability assessment scans and catalogs known weaknesses across your systems. Penetration testing goes further — manually attempting to exploit those weaknesses to prove real-world impact, the way an actual attacker would.
How long does an engagement take?
It depends on scope — a single web application typically takes 3–7 working days for a vulnerability assessment, longer for a combined VA + penetration test. You get an exact timeline before anything starts, as part of the signed scope.
Do I need to give you production access?
No. You define the scope and environment — staging, a sandboxed copy, or production with explicit written authorization, entirely your choice. We only test what you authorize, nothing more.
Will testing break anything or cause downtime?
Testing is performed carefully to minimize disruption, but any active penetration test carries a small inherent risk of instability — this is disclosed upfront, and we agree on timing/safeguards with you before starting.
What do I actually receive at the end?
A written report: every finding, its severity, evidence of how it was found, and concrete steps to fix it — plus a short executive summary you can share with non-technical stakeholders.
Do you sign an NDA / confidentiality agreement?
Yes. Confidentiality is covered in the authorization document every engagement starts with, and we can sign your own NDA as well if your organization requires it.
We're a new company with no security budget history — can you still help?
Yes — that's exactly who this is built for. Engagements are scoped to fit a single application or a specific concern, not a fixed enterprise-sized package.