Frequently Asked Questions

CyberSec provides a comprehensive suite of cybersecurity services including Penetration Testing, Attack Surface Management, Data Exposure Monitoring, Source Code Review, Cyber Investigation, and Zero Trust Architecture consulting.

We also offer broader technology services: Game Development (2D/3D, Unity, NFT), AI-driven solutions, Satellite Communications, PCB Development, Cloud Architecture, and Software Development.

We work with organizations of all sizes — from startups and SMEs to multinational enterprises and government agencies. Our service packages and engagement models are flexible to suit different budgets and risk profiles.

Smaller organizations often benefit from our automated security testing and compliance readiness services as cost-effective entry points. Larger clients typically engage us for full red team operations and managed security programs.

Getting started is straightforward. The typical process looks like this:

• Submit an enquiry via our contact form or email us directly
• We schedule a discovery call (30–60 minutes) to understand your environment and objectives
• Our team prepares a tailored scope and proposal within 2–3 business days
• Upon agreement and onboarding, we begin within your preferred timeframe

We offer both. Point-in-time assessments (penetration tests, code reviews, audits) are available as standalone engagements. We also offer continuous monitoring programs including Attack Surface Management and continuous penetration testing that provide ongoing visibility.

Retainer-based arrangements are available for clients requiring regular testing cadences or advisory access to our security team throughout the year.

Yes. Our security team holds industry-recognized certifications including:

• OSCP (Offensive Security Certified Professional)
• CEH (Certified Ethical Hacker)
• CISSP (Certified Information Systems Security Professional)
• CISA and CISM (ISACA certifications)
• CompTIA Security+, PenTest+, and CySA+
• Cloud security certifications: AWS Security Specialty, Azure Security Engineer

We have deep expertise across several regulated and high-risk industries including financial services, healthcare, government & defense, technology, e-commerce, telecommunications, and critical infrastructure.

Each industry brings unique compliance requirements and threat profiles — our team understands these nuances and tailors assessments accordingly.

Yes. Every assessment includes a remediation consultation session at no additional cost — we walk through findings, prioritize fixes, and answer your team's questions. For clients requiring hands-on remediation support, we offer dedicated remediation engagements and follow-up retesting to verify fixes are effective.

Absolutely. We routinely execute mutual NDAs before any discovery calls or information sharing. Confidentiality is foundational to our practice — your systems, vulnerabilities, and business information are never disclosed to third parties.

Yes. Our reports include a compliance mapping appendix that cross-references identified findings against applicable frameworks. We currently support mapping to PCI-DSS v4.0, ISO/IEC 27001:2022, SOC 2 (Security TSC), HIPAA, GDPR, and NIST CSF.

We can also provide a letter of attestation confirming the scope, methodology, and completion of the assessment for your auditors.

Any sensitive data encountered during testing (PII, payment card data, credentials) is handled per our strict data handling policy: it is not accessed beyond what is necessary to demonstrate the vulnerability, never exfiltrated from your environment in real form, and all test artifacts are securely destroyed within 30 days of report delivery.

Yes. As a data processor for our clients, we operate under a Data Processing Agreement (DPA) that meets GDPR requirements. We process only the minimum personal data necessary for service delivery, maintain appropriate technical and organizational measures, and support your rights as a data controller including breach notification obligations.

Yes. CyberSec carries professional indemnity (errors & omissions) insurance and cyber liability insurance. Certificates of insurance can be provided upon request during the contract stage. Coverage details are available to enterprise clients on request.

Before any testing commences, we require: a signed Statement of Work (SOW) or Letter of Authorization (LoA), an agreed Rules of Engagement document, and for cloud environments, written confirmation from the cloud provider where required (e.g., AWS requires notification for some test types).

If third-party systems are in scope (e.g., a SaaS platform you use), authorization from those system owners must also be obtained. Our team guides you through this process.