Services

Frequently Asked Questions

Do you test production environments?
Packet33 prefers to test in staging environments that mirror production. Production testing can be performed upon request with written approval and clearly defined safety parameters.

How long does a typical engagement take?
Most penetration tests take between one and three weeks depending on scope and complexity. Cloud security assessments are usually completed within five business days. We provide estimated timelines during scoping.

Do you provide reports suitable for auditors?
Yes. All Packet33 reports include an executive summary, detailed findings, remediation steps, and an attestation section. We also offer compliance mapping to frameworks such as SOC 2, HIPAA, and CIS.

What happens after testing is complete?
You will receive a final report and remediation guidance. Optional retesting can be arranged once fixes are applied to verify that vulnerabilities have been addressed.

Can you help with SOC 2 or HIPAA readiness?
Yes. Packet33’s Compliance-as-a-Service and Audit Preparation services help organizations document, implement, and maintain the controls required for frameworks like SOC 2, HIPAA, and ISO 27001.

Do you perform social engineering or phishing tests?
Packet33 provides ongoing phishing simulations and user awareness training through our Security Awareness Program. Targeted or one-time social engineering campaigns can be arranged through our partner network upon request.

How do you protect client data during assessments?
All testing is performed under strict confidentiality and within authorized scope. Data is encrypted at rest and in transit, and temporary credentials or access are securely removed after project completion.

Are you certified in SOC 2 or other frameworks?
Packet33 is not certified in SOC 2, HIPAA, or ISO 27001. We focus on helping clients prepare for certification through testing, documentation, and advisory services.

Do you sign NDAs before testing?
Yes. Packet33 signs a mutual Non-Disclosure Agreement before any engagement begins to ensure both parties’ data and findings remain confidential.

How do you determine pricing for a pentest or assessment?
Pricing depends on factors such as application size, number of assets, authentication complexity, and testing depth. A short scoping call is used to confirm scope and provide a fixed quote before work begins.

Do you provide proof of insurance?
Yes. Packet33 carries General Liability, Errors and Omissions, and Cyber Liability coverage. Proof of insurance can be shared upon request during vendor onboarding.

What industries do you work with?
Packet33 primarily serves SaaS startups and healthcare organizations, but we also work with other small and mid-sized businesses that need security testing or compliance support.

How do you handle access credentials during testing?
All credentials are stored securely in an encrypted vault and deleted immediately after project completion. Temporary accounts should be disabled by the client once testing ends.

Do you offer retesting after remediation?
Yes. Once your team has addressed the findings in our report, Packet33 can perform a focused retest to verify that vulnerabilities have been properly resolved. Retesting is optional and priced based on the scope of the fixes.