Questions we hear before every test.

We don’t work from a price list. After a short scoping conversation we send a fixed-price proposal based on your scope, at Central European rates. The price in the proposal is the price you pay – no hidden fees.

It depends on the scope and the complexity of the target. As a guide: a web application test takes 7–30 days, an infrastructure test 4–10 days and a red team engagement 4–5 days. Your proposal states the exact timeline.

Once we have agreed on the tests, the contract lists all the information we need to carry them out. The easiest way to start is a free 30-minute consultation: we go through your systems and goals together and agree on what to test.

Wherever possible we test on a test or staging environment. When production has to be tested, we agree the testing windows with you in advance and test your systems as carefully as possible, so the risk is minimal.

Yes, as a supplement. Automated tools help us in the early phases, but the testing itself is done by hand and every finding is reviewed manually before it goes into the report.

We don’t wait for the report. We notify your contact person within one business day, so you can start fixing it straight away.

Yes, on request – both inside and outside the EU.

A hand-written report with the findings in order of severity and clear remediation steps, in English or Hungarian. The results are also available on the Whiteshield online platform, and on request we walk your team through them in a consultation.

Yes, on request – if you ask for it, retesting is included in the proposal. In a consultation we help your team understand how to fix each issue, but we don’t change your code ourselves.

Yes, on request. A letter of attestation is a short, signed summary of when, what and how we tested, without the technical details – useful for your customers’ security questionnaires. If you prefer, you can of course share the full report instead.

Your data and the findings are stored in the EU and never leave it. We keep them for three months after the project, then destroy them.

Only in anonymised form. Nothing that identifies your company or your systems goes into an AI tool.

Yes, by helping you prepare. We don’t audit or certify, but for more than 15 years we have helped organisations get ready for these requirements with penetration testing: the report shows where your systems stand and what to fix before the audit.

No. Threat-led penetration testing (TLPT) under DORA is a separate, regulated exercise for the financial entities the authority designates: an intelligence-led red team test of live production systems, with an active testing phase of at least 12 weeks, overseen by the TLPT authority. A standard penetration test does not replace it.

For most AWS services – such as EC2, RDS, Lambda, CloudFront or API Gateway – no prior approval is needed. Simulated events such as red team exercises or phishing need AWS’s approval in advance, and denial-of-service testing is not allowed at all. We check AWS’s current policy for your scope in every case before testing starts.

As few people as possible – typically the CISO and the CEO. A red team exercise is an attack simulation: it shows whether your internal systems and team actually notice an attack, which only works if they don’t know it is coming.

Only if you explicitly ask for it. Operational technology is never in scope by default.