Penetration testing questions, answered.
Straight answers about how we test, how we handle your data, and what you receive. Anything missing? Ask us directly.
What is penetration testing?
Penetration testing is an authorized, simulated attack on your applications, APIs, cloud, or infrastructure that finds the vulnerabilities an attacker could actually exploit and proves their impact with evidence. At Hackstack Security every finding is manually validated and delivered with remediation guidance and a retest.
How is a penetration test different from a vulnerability scan?
A vulnerability scan is automated and lists potential weaknesses. A penetration test uses people to confirm which weaknesses are exploitable, chain them into realistic attack paths, and explain the business impact. Scanners support our coverage, but they never replace manual validation.
Do you use AI agents for penetration testing?
Yes. We run AI agents on self-hosted local models and, with your approval, on API-based frontier models to map attack surfaces, fuzz inputs, and generate attack hypotheses. Our testers cover business logic and attack chains manually, and a person validates every agent result before it is reported.
Does our data leave our environment when you use AI models?
Not by default. Local models run inside our isolated testing environment. Third-party model APIs are used only with your prior written approval and under the provider’s no-training and retention terms. We never use client data to train models.
What happens if you find no High or Critical vulnerabilities?
On an eligible penetration test, you do not pay the audit fee. If the final report contains no validated High or Critical finding, we waive the professional fee, or refund it within 30 days if it was paid in advance, subject to the guarantee terms.
How long does a penetration test take?
It depends on scope. A focused web application or API assessment typically needs one to two weeks of testing plus reporting, while multi-system or red team engagements take longer. We confirm the test window and report date in writing before any work starts.
Do you retest after we fix the findings?
Yes. Retesting agreed fixes is part of every engagement, and the final report records the closure status of each finding for your stakeholders, customers, and auditors.
How do you keep testing safe for production systems?
Every assessment starts with written authorization, an agreed scope, rules of engagement, test windows, and escalation contacts. Higher-risk techniques are agreed in advance, and we can test staging or read-only production where needed.
Where is Hackstack Security based?
Hackstack Security has offices in Ahmedabad, New York, and London, and works with product and technology teams worldwide across time zones.
Tell us what you need tested.
Share your targets, deadline, and any compliance driver. We reply with a proposed scope, test approach, and timeline. There is no obligation.