The questions we get asked most by CTOs, CISOs, and security heads in their first call. Honest, direct answers — no hedging.
How long does a network penetration test take with EyeQ Dot Net?+
Standard engagements run 5 to 10 business days from kickoff to final report, depending on scope. Emergency engagements can be completed in 3 to 5 business days subject to team availability. Free retesting after you apply fixes typically completes within 5 business days of your confirmation.
How much does a network penetration test cost in India?+
For a small to mid-sized network, expect roughly ₹25,000 to ₹4,00,000 USD equivalent depending on scope. Enterprise engagements are custom scoped. Our pricing is typically 30 to 60% lower than Big-4 firms for comparable scope, because we don't carry the same enterprise sales overhead.
Is retesting included in the price?+
Yes. One full retest after you apply fixes is included in every engagement at no additional cost. Many vendors charge separately for this — we believe a fix you can't validate isn't really a fix.
Do you give a Letter of Attestation we can share with our enterprise clients?+
Yes. After successful retest, you receive a signed letter of attestation on company letterhead that you can share with auditors, prospects in procurement, and existing customers in your trust center.
Can EyeQ Dot Net help us pass an ISO 27001 or SOC 2 audit?+
Yes. Our reports include direct mapping to ISO 27001 Annex A controls and SOC 2 Trust Services Criteria. The report is structured so your auditor can use it as evidence without additional translation work.
We failed our last audit. Can you help us pass the retake?+
Yes. We do this often. Send us the previous auditor's findings or the prior pentest report — we'll structure a re-engagement that closes those gaps specifically and gives you defensible evidence for the retake.
What's the difference between black-box, grey-box, and white-box testing?+
Black-box means we start with no prior knowledge, simulating an external attacker. Grey-box means limited credentials and partial knowledge, simulating a low-privilege insider or a phished user. White-box means full credentials and documentation, maximum coverage. Most compliance engagements use grey-box because that's what auditors expect. We offer all three.
How is EyeQ Dot Net different from Indusface, AppSecure, or other Indian VAPT vendors?+
The primary differences are speed (5–10 days vs. 4–8 weeks), price (30–60% lower for comparable scope), depth of manual testing, free retesting, and direct access to the pen tester running your engagement rather than an account manager. We're best for SMB to mid-market companies that want depth without enterprise overhead.
Our enterprise client wants a VAPT report before they sign. How fast can you deliver?+
For a standard SMB scope, you can have a delivered report in 7 business days from when you sign the contract. We've closed enterprise procurement deals for clients within two weeks start to finish. Send us the scope today and we'll have a quote back tomorrow.
What certifications does your pen testing team hold?+
Our team holds OSCP (Offensive Security Certified Professional), CEH (Certified Ethical Hacker), eJPT, CompTIA PenTest+, CEPT, and INE Cloud Associate certifications. Several team members are active bug bounty hunters with payouts from major tech companies and Indian fintechs.
Does EyeQ Dot Net provide CVSS scoring on findings?+
Yes. Every finding in our report is scored using CVSS v3.1, with the full vector string included so your team can validate the severity rating themselves. We also provide a risk-prioritized remediation order, not just a list.
Can you help with a PCI-DSS Requirement 11.4 network pentest?+
Yes. We do PCI-DSS-aligned segmentation testing between CDE and non-CDE networks, plus external and internal pentest coverage. The report is structured to satisfy PCI-DSS auditor requirements directly.
Do you test internal networks remotely or do you need to come on-site?+
Both options work. Remote internal testing is done through a hardened jump-box or VPN we provide. On-site testing is available for clients in or near Mangalore and Bangalore, or for higher-classification engagements where remote isn't appropriate.
Do you provide a sample report before we engage?+
Yes. On a discovery call we can walk you through a redacted sample that shows the structure, depth of analysis, and remediation guidance you'll receive in your final deliverable.
