Question 1

Is ethical hacking legal?

Accepted Answer

Yes, completely legal. Ethical hacking — also known as 'authorized penetration testing' — is legal when it takes place with explicit written consent from the system owner. GetHacked works exclusively with a signed consent agreement. Without a mandate, we conduct no testing. Ever.

Question 2

What is the difference between pentesting and vulnerability scanning?

Accepted Answer

A vulnerability scan is an automated scan that identifies known vulnerabilities based on a database. It's fast but misses business logic flaws, complex vulnerabilities and the human factor. Penetration testing goes much further: an experienced ethical hacker actively tries to break in, exploits vulnerabilities and simulates a real attack.

Question 3

Is this suitable for small businesses?

Accepted Answer

Absolutely. Cybercriminals don't discriminate based on company size. SMBs are often easier targets because they invest less in security. We have packages specifically designed for SMBs and startups, both in terms of price and approach.

Question 4

How long does a security audit take?

Accepted Answer

It depends on scope. A Quick Security Scan takes 1-2 working days. A Business Pentest of a web application averages 3-5 working days. A full Advanced Security Audit of a larger organization can take 2-4 weeks.

Question 5

Do we get a report?

Accepted Answer

Yes, always. Every security engagement concludes with a comprehensive report: an executive summary for management (non-technical), a technical detailed report for the IT team, CVSS scores per vulnerability, screenshots and proof-of-concept demonstrations, and concrete recommendations per finding.

Question 6

Can you also fix vulnerabilities?

Accepted Answer

Yes, that is possible. After the report, you can optionally choose our Remediation Support. We provide technical advice, review your team's fixes, assist with configuration changes and conduct a re-test to confirm everything is resolved.

Question 7

What if you find a critical vulnerability?

Accepted Answer

With a critical vulnerability, we contact you immediately — during the testing period — so you can take immediate action. We don't wait for the final report. Critical findings are communicated by phone and then documented in writing.

Question 8

What happens to our data?

Accepted Answer

Your data is used exclusively for the security test and never shared with third parties. All findings, screenshots and test data are treated with strict confidentiality. After the project, all collected test data is securely deleted. An NDA is standard included.

Question 9

Do you work discreetly?

Accepted Answer

Absolute discretion is one of our core principles. We communicate exclusively with the contact persons you designate. We never discuss your security situation or findings with external parties. Even the fact that we conducted a security test remains confidential.

Question 10

Can you test our production environment?

Accepted Answer

Yes, but we take extra precautions. We plan tests outside business hours, communicate in real-time about our activities and stop immediately at signs of unintended impact. Where possible, we work with a staging environment that mirrors production.

Question 11

Can you conduct phishing tests?

Accepted Answer

Yes, phishing simulations are one of our standard services. We develop realistic phishing scenarios tailored to your organization and measure how well your employees recognize them. We report per department and employee category. After the simulation, we offer targeted training.

Question 12

Are employees informed in advance?

Accepted Answer

That's up to you. A 'blind' phishing test gives the most realistic results, but you can also choose an announced test as part of a broader awareness campaign. In both cases, we always inform the responsible person in your organization.

Everything you want to know

General

Reports and results

Privacy and security

Phishing and training

Nog een vraag?