FAQ
Frequently Asked Questions
Answers to common questions about penetration testing, security assessments, and working with Pentrox.
Before an assessment begins
Procurement, data handling, and logistics questions answered before the first day of testing. Legal identity, insurance, and liability questions are answered in detail on the Trust and Procurement page
Data Handling and GDPR
Is Pentrox a data controller or data processor for findings data?
Pentrox acts as data processor under the GDPR for all client data processed during an assessment. A Data Processing Agreement (DPA) is signed before any assessment begins. The legal basis for processing is the legitimate interest of the client in identifying security vulnerabilities in its own systems. Pentrox does not process findings data for any purpose other than delivering the agreed assessment.
What is the data retention and destruction policy?
Assessment data, including findings, evidence, and reports, is retained for a defined period after project completion to support retesting and follow-up questions. After the retention period, all project data is permanently deleted. Clients may request early deletion at any time. Retention periods and destruction procedures are specified in the Data Processing Agreement.
Does Pentrox use subprocessors, and where is data stored?
Pentrox minimises the use of subprocessors. All assessment data is stored within the European Economic Area (EEA). The Pentrox Portal, where findings and reports are published, is hosted in a datacenter in the European Union; traffic to it passes through Cloudflare, a United States company certified under the EU-U.S. Data Privacy Framework, in transit only. A current list of subprocessors is included in the Data Processing Agreement and is provided upon request before signing.
Personnel
What background screening do Pentrox employees undergo?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold recognised certifications such as OSCP (Offensive Security Certified Professional), OSCE (Offensive Security Certified Expert), OSWE (Offensive Security Web Expert), eWPTX (eLearnSecurity Web Application Penetration Tester eXtreme), eMAPT (eLearnSecurity Mobile Application Penetration Tester), CPTS (Hack The Box Certified Penetration Testing Specialist), CWES (Hack The Box Certified Web Exploitation Specialist) and BSCP (PortSwigger Burp Suite Certified Practitioner). Every assessment is executed or supervised by senior penetration testers, and internal quality review is performed before any report is delivered.
Assessment Logistics
How quickly are critical findings communicated during testing?
Critical or blocking findings are communicated immediately upon identification, before the final report is delivered. This allows remediation to begin during the assessment rather than after it. The notification method (phone, email, or portal alert) is agreed during the scoping phase. All other findings are published in the Pentrox Portal as the assessment progresses.
Is a mutual NDA available before scoping begins?
Yes. Pentrox provides a mutual Non-Disclosure Agreement as standard before any scoping information is exchanged. A Pentrox NDA template is available upon request. Client-provided NDA templates are also accepted and reviewed promptly.
Deliverables and Retesting
When is the final report delivered, and what does it contain?
The final report is delivered within five business days after completion of testing. Every report includes an executive summary with findings grouped by severity and business impact, a vulnerability overview with prioritised remediation guidance, a technical conclusion addressing underlying control gaps, the assessment scope and methodology, and detailed technical findings with evidence, reproduction steps, risk ratings, and remediation steps. Reports are structured for both executive leadership and technical delivery teams. Four report types are available through the Pentrox Portal: Initial Report, Management Report, Retest Report, and Retest Management Report.
Is retesting included as standard, and how many cycles are covered?
Retesting of remediated findings is included with every assessment at no additional charge. Once fixes have been applied, Pentrox verifies each remediated finding to confirm whether the fix is effective. If some findings remain open after the first retest, additional retest cycles can be requested. The full retest workflow is managed through the Pentrox Portal, where findings can be flagged for retest, retest dates are scheduled, and results are published per finding.
Pricing and Scoping
What information is needed to scope an assessment?
Scoping starts with a brief intake conversation or a completed intake checklist through the Pentrox Portal. Typical information includes the type of target (web application, API, mobile application, infrastructure, cloud environment), the number of user roles and authentication flows, the preferred testing approach (white box, grey box, or black box), any compliance requirements (NIS2, PCI-DSS, ISO 27001, DigiD), and the preferred testing window. Pentrox responds to all enquiries within one business day.
How is a penetration test priced?
Pricing is based on the estimated number of testing days, which is determined during scoping. Factors that influence the estimate include the size and complexity of the target environment, the number of user roles and features to test, the chosen testing approach, and any compliance requirements. Pentrox provides a fixed-price quotation after scoping is completed. There are no hidden costs: retesting, the Pentrox Portal, and all report types are included as standard.
Are indicative size bands available for budgeting purposes?
Pentrox does not publish fixed price lists because every environment is different. However, indicative sizing is discussed during the scoping conversation to support internal budget planning. A focused web application assessment typically requires three to five testing days. Broader assessments covering infrastructure, multiple applications, or compliance requirements take longer. Pentrox provides a written quotation with a clear day estimate after scoping, so there are no surprises.
How an assessment runs
From scoping through reporting and retesting: what to expect during a Pentrox security assessment.
What is penetration testing?
Penetration testing is a controlled security assessment in which ethical hackers attempt to exploit vulnerabilities in your systems before malicious actors can. The goal is to identify real attack paths, assess business impact, and provide actionable guidance to reduce risk. Pentrox combines manual expertise with proven methodologies to deliver findings that are both technically accurate and practically useful.
How long does a penetration test take?
Duration depends on the scope and complexity of the target environment. A focused web application assessment typically takes three to five days, while broader infrastructure or red team assessments may span several weeks. During scoping, Pentrox works with you to define the right depth and timeframe to meet your objectives and deadlines.
What is the difference between white box, grey box, and black box testing?
White box testing gives the tester full access to source code, architecture documentation, and credentials, enabling the deepest and most thorough coverage. Grey box testing provides limited information such as user credentials or partial documentation, simulating a compromised insider or known-user scenario. Black box testing starts with no prior knowledge of the target, simulating an external attacker discovering and exploiting vulnerabilities from scratch. Pentrox recommends the most appropriate approach based on your objectives.
What types of systems can Pentrox test?
Pentrox tests a broad range of environments including web applications, APIs, mobile applications (iOS and Android), internal and external network infrastructure, cloud platforms (AWS, Azure, GCP), source code, embedded devices, and IoT systems. Compliance-focused assessments are also available for NIS2, PCI-DSS, ISO 27001, and DigiD standards.
How is Pentrox different from automated scanning tools?
Automated scanners identify known patterns but cannot reason about business logic, chain vulnerabilities, or confirm actual exploitability. Pentrox uses automated tools as a starting point, followed by hands-on manual testing by experienced ethical hackers. Every finding is manually validated, which eliminates false positives and provides real-world attack paths that scanners cannot surface.
What certifications does the Pentrox team hold?
Pentrox team members hold recognised certifications such as OSCP (Offensive Security Certified Professional), OSCE (Offensive Security Certified Expert), OSWE (Offensive Security Web Expert), eWPTX (eLearnSecurity Web Application Penetration Tester eXtreme), eMAPT (eLearnSecurity Mobile Application Penetration Tester), CPTS (Hack The Box Certified Penetration Testing Specialist), CWES (Hack The Box Certified Web Exploitation Specialist) and BSCP (PortSwigger Burp Suite Certified Practitioner). All employees undergo PES (Personnel Screening) background checks, and every assessment is executed or supervised by senior penetration testers. Internal quality review is performed before any report is delivered.
What does a penetration test report include?
Every Pentrox report includes an executive summary with findings grouped by severity and business impact, a vulnerability overview with prioritised remediation guidance, a technical conclusion addressing underlying control gaps, the assessment scope and methodology, and detailed technical findings with evidence, reproduction steps, risk ratings, and remediation steps. Reports are structured for both executive leadership and technical delivery teams.
Is retesting included?
Yes. Retesting of remediated findings is part of every Pentrox assessment at no additional charge. Once your team has addressed vulnerabilities, Pentrox re-evaluates each remediated item to confirm whether the fix has been applied effectively. The full retest workflow is managed through the Pentrox Portal, supporting multiple retest cycles if needed.
What is the Pentrox Portal?
The Pentrox Portal is a secure, dedicated client platform accessible at portal.pentrox.nl. It provides real-time visibility into project progress, published findings, reports, and remediation status throughout the entire assessment lifecycle. Clients can track findings, flag items for retest, download all reports, exchange documents securely, and manage team access. All Pentrox Portal users are protected by mandatory two-factor authentication.
Do you test in production environments?
Pentrox prefers to test in non-production environments to avoid any disruption to business operations. All testing is performed in a controlled, non-destructive manner regardless of environment. Where production testing is required, this is agreed explicitly during scoping, and testing windows are planned to minimise any operational impact. Critical findings are communicated immediately upon identification.
What compliance standards can Pentrox help with?
Pentrox offers compliance-aligned penetration testing for NIS2, PCI-DSS, ISO 27001, and DigiD. These assessments validate security controls against the specific requirements of each standard and produce reports structured for certification bodies, auditors, and regulators. Pentrox can also support organisations working toward multiple certifications simultaneously.
How quickly can a penetration test be scheduled?
Pentrox responds to all enquiries within one business day. Scheduling depends on availability and the complexity of the required scoping. Straightforward assessments can often be planned within one to two weeks. For urgent requirements, contact Pentrox directly to discuss prioritised availability.
Ready to Secure Your Environment?
Schedule a free intake call to scope your assessment. Pentrox identifies vulnerabilities in your applications, infrastructure, and cloud environments before attackers do.
Schedule an intake call