FAQ
Everything clients ask us,
Everything clients ask us,
answered plainly.
Pricing, methodology, confidentiality and retesting — answered as they are, no marketing.
01 · Pricing & payment
How is an engagement priced?
Three factors: the size of the scope (how many apps and APIs), the depth of testing you need, and the timeline. Together they set the program's agreed budget — one amount for the whole engagement, payable only if a Critical or High finding is confirmed, with no per-finding charges or hidden fees.
What if you don't find a critical or high vulnerability?
The invoice is zero. We carry the risk entirely — you pay only if we document a Critical or High vulnerability that is exploitable and verified by hand; otherwise the test and its report are free and delivered as usual.
Is there a minimum engagement?
No. We price a single service on a small scope the same way we price a full engagement — pricing that works for startups and mid-size companies.
02 · Testing & methodology
How long does testing take?
It depends on the scope, but most engagements are completed within 5 to 10 working days. From the first call you get a clear timeline: when testing starts, when the report lands, and when retesting begins.
Is testing safe on production?
Yes. Rules of engagement are signed before we start: agreed time windows, testing limits and immediate escalation channels. We test like a real attacker without disrupting your operations.
Who actually tests us?
Top-ranked Saudi penetration testers — not automated scanners stamped into a translated report. Every finding is manual, verified and reproduced before delivery.
Do you cover GraphQL and mobile?
Yes: web, REST and GraphQL, iOS and Android, and authentication systems (JWT / OAuth / SSO). We test external systems only; internal networks and on-premise infrastructure are out of scope. Each service is scoped and priced on its own.
03 · Reports & confidentiality
What does the final report look like?
For every vulnerability: full reproduction steps, evidence, an official CVSS v4 score, business-impact analysis and remediation guidance — followed by a free retest that closes the loop. See how a finding is presented in the report.
Are our findings and data confidential?
Completely. An NDA is signed before any engagement, evidence and reports never leave your approved channels, and they are destroyed after the agreed retention period.
Will regulators accept the report?
Our reports are documented in line with the NCA ECC and SAMA CSF controls, and we are licensed by the National Cybersecurity Authority (NCA).