Frequently Asked Questions

Answers to common questions about our methodology, CVSS scoring, compliance alignment, and tooling.

What methodology do you follow?

PTES and the OWASP Testing Guide, adapted per engagement. API work follows the OWASP API Security Top 10; mobile follows OWASP MASVS.

Do you provide CVSS scoring?

Yes, CVSS v3.1 for every finding, with a business-impact narrative alongside the score.

Can your reports be used as SOC 2 / PCI DSS evidence?

Yes, tell us your framework during scoping and we'll align structure and terminology accordingly.

Do you test in production or staging?

Either, blast radius and safe-testing constraints are discussed during scoping.

What tools do you use?

Burp Suite Professional, Nmap, Metasploit, BloodHound, Frida, MobSF, plus custom tooling for specific attack classes.

How do you handle critical findings during the engagement?

Disclosed immediately upon discovery, not held until the final report.

Do you work with companies outside Pakistan?

Yes, engagements delivered across the US, UK, EU, and Middle East.

Will you sign our NDA or security questionnaire?

Yes, standard for every engagement.