Choosing a pentest

1. Which organizations are our pentest services for?
2. What is the difference between a vulnerability scan and a penetration test?
3. Is a network scan or vulnerability scan sufficient security?
4. What is the difference between black-box, grey-box and white-box pentests?
5. Do you also perform pentests on mobile apps and APIs?
6. Can you perform pentests in cloud environments (Azure, AWS or GCP)?
7. What are the advantages of a scan sensor?

Quality and trust

1. Why is your application a target for hackers?
2. Why choose DongIT as your pentest partner?
3. What certifications do your pentesters hold?
4. What are the advantages of manual testing methods?
5. Does a pentest guarantee 100% security of my application?

Preparation and planning

1. What is the best timing to perform a pentest?
2. How often should I perform a pentest?
3. What is the lead time for a pentest?
4. How do you prepare for a pentest?
5. What information must be provided in advance for a pentest?
6. Why pentest on an acceptance or test environment?
7. Test and production on the same server: what is the risk?
8. Why whitelist IP addresses during a pentest?
9. Why adjust SMTP settings during a pentest?

Reporting and follow-up

1. What is the difference between an OWASP Top 10 and NCSC report?
2. Can I see a sample report before I decide?
3. What happens when critical vulnerabilities are found?
4. How does an effective retest work?
5. Can I get help fixing vulnerabilities?

Compliance and confidentiality

1. Is your work compliant with NIS2, DORA, DigiD or MIAUW?
2. Do you work with an NDA and how is my data protected?
3. Can I share the report with auditors or customers?