Vulnerability Management | Risk-Based Remediation

A vulnerability scan (VA) is a scanning process that detects known security weaknesses with automated tools. A penetration test, on the other hand, is an advanced security test that, from the perspective of a real attacker, manually attempts to penetrate systems and discovers chained vulnerabilities. While VA answers “what vulnerabilities are there?”, a pentest answers “how deep can I go with these vulnerabilities?”. For comprehensive security, using both together is recommended.

The frequency of penetration testing varies according to the industry, risk profile and compliance requirements. Standards such as PCI-DSS require a pentest at least once a year and after significant system changes. The general recommendation is: at least 1 comprehensive pentest a year, quarterly vulnerability scans and a test before every major deployment/update. For high-risk sectors (finance, healthcare) a test every 6 months is recommended.

Black box: The test team has no information about the target and simulates the perspective of a real external attacker. White box: All information such as source code, architecture diagrams and credentials is shared, enabling comprehensive, in-depth testing. Gray box: Limited information (for example a low-privilege user account) is provided to test an insider threat or restricted-access attacker scenario. There is no single best; it is chosen according to the goal and budget. For comprehensive security, white box is recommended; for real attack simulation, black box.

Professional penetration tests are performed by experienced experts in a controlled environment and prioritise system stability. However, rarely (especially on old/unstable systems) there is a risk that exploitation attempts could cause downtime. For this reason, the RoE (Rules of Engagement) agreement before the test details which tests will be performed, which critical systems will be excluded from scope and the emergency procedures. For critical systems, a maintenance window or staging environment can be used.

The duration varies by scope and complexity. A typical web application pentest takes 1-2 weeks, an enterprise network pentest 2-4 weeks, and a Red Team operation 4-8 weeks. The process: 1 week planning + 1-3 weeks active testing + 1 week reporting, averaging 3-5 weeks. Express pentest packages (limited scope) can be completed within 3-5 business days. Vulnerability scans usually conclude within 1-2 days.

The pentest cost varies according to the following factors: scope size (how many applications/IPs/endpoints), test type (black/white box), depth level, time constraint, retest need. A web application pentest averages 15,000-50,000 TL, a comprehensive enterprise infrastructure pentest 75,000-200,000 TL, and a Red Team operation 150,000 TL+. Vulnerability scans start in the 5,000-15,000 TL range. For an exact price, a free preliminary assessment meeting is recommended.

All pentest projects are conducted under an NDA (Non-Disclosure Agreement). Test data and reports are shared through encrypted channels and securely destroyed at the end of the project (archived if requested). Our team works with an ISO 27001-certified information security management system. Sensitive data accessed during the test (payment information, PII) is never copied or stored; only its existence is verified. Reports are delivered as encrypted PDFs and protected against unauthorised access.

We provide a retest (remediation verification) service to verify the remediations made within 60-90 days after report delivery. The first retest is usually provided free of charge or at a discount for critical findings (varies by package/contract). The retest scope covers only the remediated findings; it is not a new full-scope test. After remediation, we issue a “clean report” and provide documentation so you can use it in your compliance processes.