Questions, answered plainly.
Twenty questions we hear most. If yours is not here, ask us directly.
What is penetration testing?
Penetration testing is an authorised, controlled attack on your systems. Testers use the same techniques a real attacker would to find and safely prove weaknesses, so you can fix them before they are abused.
What is VAPT?
VAPT stands for Vulnerability Assessment and Penetration Testing. The assessment gives broad coverage of known weaknesses. The penetration test goes deeper and proves which ones can be exploited and what the impact would be.
What is red teaming?
Red teaming is a goal driven simulation of a real adversary. Instead of listing every vulnerability, the team tries to reach agreed objectives while testing how well your people and controls detect and respond.
How long does a penetration test take?
It depends on scope. A single application often takes one to three weeks, and larger estates take longer. We confirm the timeline during scoping, before work begins.
What applications can Security Loyals test?
Web applications, Android and iOS apps, REST, GraphQL and SOAP APIs, thick client desktop software, cloud workloads, and IoT and OT systems.
Do you provide API security testing?
Yes. We test APIs against the OWASP API Security Top 10 with a strong focus on object level and function level authorisation.
Do you test mobile applications?
Yes. We test Android and iOS apps, including local storage, reverse engineering, transport security and the backend APIs the app depends on.
Do you perform cloud security assessments?
Yes. We assess AWS, Azure and Google Cloud environments for misconfiguration, identity and access weaknesses, exposed storage and privilege escalation paths.
What does a security assessment report contain?
An executive summary, scope and methodology, each finding with severity, evidence and reproduction steps, the business risk, and specific remediation guidance.
Do you provide remediation support?
Yes. We walk your developers and administrators through each finding and stay available for questions while they fix it.
Do you provide retesting?
Yes. Once fixes are in place we retest the affected items and update the report with the verified status.
What security standards do you follow?
Our work references the OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, OWASP MASVS, CWE Top 25, PTES, NIST guidance and MITRE ATT&CK, as applicable to the engagement.
Do you provide compliance focused assessments?
We can align testing scope and reporting to the security testing requirements of the framework you work under. Tell us which one applies and we will scope accordingly.
What is source code analysis?
Source code analysis examines an application's code for security weaknesses such as injection, weak cryptography and hardcoded secrets. It finds issues that are hard to see from the outside.
What is GARUDX?
GARUDX is the source code analysis platform from Security Loyals. It scans code, classifies findings by severity, maps them to CWE and OWASP, and gives developers remediation guidance.
What is Security Radar?
Security Radar is the vulnerability and asset management platform from Security Loyals. It gives one view of your digital assets, their vulnerabilities and the progress of remediation.
Can Security Radar monitor digital assets?
Yes. Security Radar maintains an asset inventory, supports asset discovery and continuous scanning, and tracks the risk attached to each asset over time.
Can GARUDX generate PDF and Word reports?
Yes. GARUDX produces reports in PDF, Word and Excel formats.
How can I request a product demo?
Use the contact page and choose Security Radar demo or GARUDX demo as the service required. We will reply to arrange a session.
How can I request a penetration testing assessment?
Use the contact page, choose the service you need and describe the scope. You can also email business@securityloyals.com.