Frequently asked questions about pentests and security

All the answers about penetration tests (pentests), security audits and what you can expect from them, in plain language. Is your question not listed? Ask it through the contact form; you will get an answer from the specialist who does the work.

What is a pentest?

A penetration test (pentest) is a controlled security assessment in which a specialist uses the techniques of a real attacker to try to break into your systems. All findings are documented in a report that states the risk and concrete remediation advice for each vulnerability. This way you know where you are vulnerable before an attacker finds out.

What is the difference between a pentest and a vulnerability scan?

A vulnerability scan is automated and mainly finds known vulnerabilities and configuration errors. A pentest goes further: a specialist combines findings, thinks like an attacker and demonstrates what is actually possible. The scan is the smoke detector, the pentest is the fire drill. The ideal is to combine both: scan periodically, test annually.

What do black box, gray box and white box mean?

The difference lies in how much prior knowledge the tester has. Black box: no prior knowledge at all, like an external attacker. Gray box: limited prior knowledge, such as a test account or documentation. White box: full access, up to and including the source code. For most organizations gray box offers the best insight, because no testing time is lost on guesswork.

Which types of pentests does Secure Sense perform?

Secure Sense tests web applications and APIs, networks and infrastructure (internal and external) and Microsoft 365 environments. We also run phishing simulations and combine test types in consultation with you, for example a web application pentest with a secure code review of the source code.

Is a pentest the same as a security audit?

Not exactly. A security audit is the broader term: any systematic assessment of your security. A pentest is the most practical form, in which a specialist actually demonstrates what an attacker can do. At Secure Sense the pentest is the core of almost every security audit.

How long does a pentest take?

Most pentests involve 16 to 40 hours of testing, spread over one to two weeks. An average web application takes 16 to 24 hours, an extensive application or an infrastructure test 40 hours or more. We determine the exact scope during the free intake call, and after that you also know when the report will be ready.

Can a pentest disrupt our systems?

The chance of that is small. We test cautiously, agree on risky actions with you in advance and can switch to a staging environment or to times outside office hours if needed. Preventing disruption is a standard part of our preparation for every pentest.

What do you need from us?

Not much: a clear scope, a contact person, formal authorization and, in the case of a gray box test, something like a test account. We guide you step by step through the preparation, including the coordination with your hosting provider if that is needed.

Does our hosting provider need to give permission?

Often yes: many hosting providers want to know in advance that a pentest will take place on their infrastructure, and some ask for formal approval first. We know the usual procedures and help you arrange that permission quickly, so the test can start as planned.

What does the pentest report contain?

The report contains a management summary in plain language, the scope and approach, and for each finding the risk rating (based on CVSS), the evidence with steps to reproduce and concrete remediation advice. This allows your management to make decisions and your IT provider to get started right away.

Do you also help with fixing the issues?

Yes, with advice and guidance. The report contains concrete remediation advice for each finding, and during the personal walkthrough we go through the approach, with your IT provider present if you wish. The remediation itself is carried out by your own team or supplier; we remain available for questions during that process.

What is a retest?

In a retest we check after remediation whether the vulnerabilities we found have actually been resolved. You receive a confirmation of this, so you can also demonstrate to customers or auditors that the findings have been fixed. The retest is an optional extra check after the pentest.

What does a pentest cost?

There is no standard price: the cost depends on the size of the scope, the depth and the type of test. In a short, free intake call we determine the size of the job together. After that you receive a quote with a fixed price, so you are never faced with surprises. Read which factors determine the price.

How do you handle confidential information?

With great care, because discretion is a core value for us. Confidentiality is a standard part of our agreements, we handle test data and findings carefully and the report is and remains your property. We also do not communicate anything about the existence of the engagement without your explicit permission.

Why should I choose a small firm?

Because at Secure Sense you always deal directly with the specialist who tests your systems personally, from the intake call to the retest. That means short lines of communication, no misunderstandings through account managers, and a report written by someone who really knows your situation.

Is a pentest mandatory?

No law requires every company to have a pentest. But the Dutch Cyberbeveiligingswet (NIS2 law) requires organizations to assess the effectiveness of their security, ISO 27001 expects periodic testing, and more and more customers and insurers ask for a recent pentest report as proof.

How often should you have a pentest performed?

The rule of thumb is at least once a year, and also after major changes such as a new application, a migration or an acquisition. Each of those changes can introduce new vulnerabilities. Between pentests, vulnerability scanning continuously keeps an eye on your environment, so known vulnerabilities do not stay unnoticed for a year.

Does a pentest help with the NIS2 law?

Yes. The duty of care in the NIS2 law requires organizations to assess whether their security measures work, and a periodic pentest is the most concrete way to do that. If you do not fall under the law yourself, the report is the proof you use to answer supply chain questions from large customers.

We are only a small company. Is this relevant for us?

Yes. Smaller companies in particular are an attractive target: attacks are largely automated and do not distinguish by company size. In addition, large customers increasingly pass their security requirements on to smaller suppliers. A pentest makes your security demonstrable, which also pays off commercially.

Want to know where you stand? Request a no-obligation quote; you will hear personally from the specialist who will also perform your pentest.

Last updated: October 20, 2026.