Frequently Asked Questions

What types of security assessments do you offer?

+

Vulnera offers comprehensive security assessment services including:

● Penetration Testing: External and internal network testing, application security, wireless assessments, social engineering
● Red Team Exercises: Advanced adversarial simulations, multi-stage attacks, persistence testing
● Web Application Security: Source code review, API security, OWASP testing
● Mobile Security: iOS and Android application testing, mobile infrastructure
● Cloud Security: AWS, Azure, GCP configuration and security assessment
● Infrastructure Assessment: Network, systems, identity and access management
● Compliance Assessments: ISO 27001, PCI-DSS, HIPAA, SOC 2 evaluations

Will testing cause downtime to our systems?

+

No. Our testing is carefully designed to avoid disruption:

✓ Controlled Scope: We establish clear testing boundaries and rules of engagement before assessment begins
✓ Non-Destructive: Our testing identifies vulnerabilities without damaging systems or data
✓ Scheduled Coordination: We work during agreed-upon windows and maintain communication with your teams
✓ Graceful Failure: If we identify a critical issue, we stop immediately and report it
✓ Production systems are tested in a manner that validates real-world risk without operational impact

What certifications does your team hold?

+

Our team maintains industry-leading certifications:

✓ CCNP Security (Cisco)
✓ CREST-Level (Advanced Pen Testing)
✓ CEH (Certified Ethical Hacker)
✓ OSCP (Offensive Security)

✓ FCSS (Google Cloud Security)
✓ CISSP (Information Security)
✓ AWS/Azure Security certifications
✓ Continuous professional development

Certifications are maintained and renewed regularly. All team members commit to staying current with emerging threats and technologies.

What does a typical report include?

+

All Vulnera reports include:

✓ Executive Summary: High-level overview, risk score, and key findings for non-technical stakeholders
✓ Technical Findings: Detailed vulnerability descriptions, CVSS scores, evidence, and reproduction steps
✓ Risk Scoring: CVSS v3.1 scoring and business risk prioritization
✓ Remediation Guidance: Step-by-step instructions for fixing each vulnerability
✓ Compliance Mapping: Correlation with ISO 27001, PCI-DSS, HIPAA, and other standards
✓ Retest Validation: Free retesting to verify remediation effectiveness
✓ Timeline & Recommendations: Prioritized remediation roadmap aligned with your business

Do you offer retesting?

+

Yes. Retesting is included free as part of every assessment:

✓ Included Retesting: One full retest is included to verify remediation of all findings
✓ Flexible Timing: Schedule retesting when remediation is complete (typically 30-60 days after report)
✓ Same Tester: Original assessor conducts retesting for continuity and expertise
✓ Additional Retests: Additional retests available at discounted rates if needed
✓ Documentation: Closure report confirming remediation effectiveness provided

Do you work with banks and government?

+

Yes. We have extensive experience in highly regulated sectors:

✓ Banking Sector: Trusted by banks and finance industries in Oman. PCI-DSS expertise.
✓ Government & Public Sector: Proven experience with national agencies and critical infrastructure operators
✓ Classified Environments: Clearance holders available for testing sensitive systems
✓ Regulatory Knowledge: Deep understanding of banking regulations, national security requirements, and government compliance standards
✓ Sensitive Handling: Strict confidentiality and secure data management for government and financial clients

Can you test our internal network?

+

Absolutely. We offer flexible deployment options:

✓ VPN Access: Remote testing through secure VPN tunnel to your internal infrastructure
✓ On-Site Testing: Physical presence at your facility for direct network access and social engineering
✓ Hybrid Approach: Combination of remote and on-site assessment for comprehensive coverage
✓ Air-Gapped Networks: Specialized protocols for testing isolated or classified networks
✓ Scoping Call: We discuss your environment and determine the best testing approach

How long does a typical assessment take?

+

Assessment duration depends on scope and complexity:

✓ Web Application: 1-2 weeks (depending on size and complexity)
✓ Network Penetration Testing: 2-3 weeks (external + internal, typical enterprise)
✓ Red Team / Full Simulation: 4-6 weeks (multi-stage, persistence-focused)
✓ Compliance Assessment: 1-4 weeks (depending on framework and infrastructure size)
✓ Reporting: 2-3 weeks from testing completion for comprehensive report and analysis

Timeline discussed and agreed upon during scoping call. Custom assessments may require different timeframes.

Is our data kept confidential?

+

Yes. Confidentiality is paramount:

✓ NDA Coverage: Comprehensive non-disclosure agreement protecting all assessment data
✓ Encrypted Communications: All findings, reports, and data transmitted over encrypted channels
✓ Secure Storage: Assessment data stored in encrypted databases with access controls
✓ Data Destruction: All assessment materials securely deleted after engagement concludes
✓ No Third Parties: Your data is never shared with external vendors or intelligence services
✓ Legal Compliance: Full GDPR and data protection regulation compliance

How do we get started?

+

Getting started is simple:

1.

Initial Contact

Email sales@vulnera.om or fill out the contact form with your security assessment needs

2.

Scoping Call

Schedule a 30-minute call to discuss your organization, infrastructure, and assessment objectives

3.

Proposal & NDA

Receive detailed proposal with scope, timeline, and pricing. Execute NDA for data protection.

4.

Assessment

Begin testing according to agreed scope, rules of engagement, and schedule

5.

Reporting & Support

Receive comprehensive report with findings, guidance, and support for remediation