Frequently asked questions
Short, straight answers. If yours isn't here, ask us.
About penetration testing
What is a penetration test?
A controlled, authorised simulation of a real attack on your systems. A tester looks for weaknesses, tries to exploit them safely, and reports what an attacker could achieve and how to fix it.
What's the difference between a vulnerability scan and a penetration test?
A scan is automated and lists possible issues. A penetration test uses a skilled person to confirm which issues are real, chain them together the way an attacker would, and find logic flaws scanners cannot see.
How often should we test?
At least once a year, and after significant changes such as a new application, a major release, or changes to your network or hosting.
Which test do we need?
It depends on why you need one: a customer requirement, a certification, a launch or general assurance. Tell us the reason and we will recommend the smallest scope that answers it.
Working with us
How quickly can you quote?
Within three working days of receiving your scoping details or having a short call.
How long does a test take?
Most tests take a few days of testing. You receive the report within five working days of testing ending.
Can you test outside office hours?
Yes, evenings or weekends, at no extra cost.
Is a retest included?
Yes. One retest of the findings is included if you request it within 90 days of the report.
Can we see a sample report?
Yes. Ask through the quote form and we will send a redacted sample report to your work email.
Who will actually do the testing?
A senior penetration tester with over ten years of experience. You speak to them directly from scoping to debrief.
Safety, legal and accreditation
Will testing disrupt our systems?
We avoid denial-of-service and destructive techniques, agree risky steps with you first, and stop immediately if anything looks wrong.
Do you need access to our systems?
It depends on the test. External testing needs nothing installed. Internal and application testing usually needs a user account and, for internal tests, a remote testing device or VPN.
What paperwork is involved?
A mutual NDA, a short services agreement, a signed testing authorisation letter and agreed rules of engagement. We provide all of them.
How do you protect our data?
Evidence is kept to the minimum, encrypted at rest and in transit, delivered through an encrypted channel and securely deleted after the agreed period.
Are you CREST accredited?
No. Smart VAPT is not a CREST-accredited company, and we will tell you up front if your requirement needs one. Our quality comes from a senior, certified tester following recognised methodologies, and we are happy to share a sample report and certification details before you commit.
Still have a question?
Email info@smartvapt.com or send your details through the quote form. You'll hear back within three working days.