Frequently asked
questions.

Broonat offers penetration testing, compliance assessments and vCISO services for growing technology businesses. The right starting point depends on whether you need to find technical weaknesses, understand compliance gaps or set a clearer security direction.

Testing can cover external infrastructure, web applications and APIs, internal networks, and cloud environments. The targets, testing depth and boundaries are agreed before work begins. Different testing types can be combined when needed.

We start by understanding your systems, goals, risk profile and any relevant deadlines. Before testing, we agree the targets, access, testing windows, rules of engagement and a point of contact.

Be ready to discuss the systems you want tested, what you want to learn and any timing or access requirements. We’ll agree the scope and practical arrangements with you before testing starts.

Testing is conducted within the agreed scope and rules of engagement. We’ll agree testing boundaries, timing and how to handle urgent findings before work begins.

We’ll follow the escalation route agreed with you before testing. Urgent findings are raised through that agreed channel.

You’ll receive a report with validated findings, reproduction steps and supporting evidence, including affected assets and the conditions needed to exploit each weakness. Findings are prioritised with technical severity and business context, alongside practical remediation guidance. The engagement also includes a findings walkthrough with your team.

Yes. Findings are presented in a clear order of action, with business context to help your team prioritise remediation and understand the trade-offs.

We’ll agree whether a retest is needed and include it in the scope if required.

A penetration test investigates exploitable weaknesses in agreed systems. A compliance assessment helps you understand gaps against the requirements relevant to your organisation. We’ll define the assessment’s criteria and scope with you before work begins.

The vCISO service is for organisations that need clearer security direction. We’ll discuss your current needs and priorities, then agree the scope of support and practical next steps.

Fees depend on the agreed scope, testing depth and timing. We confirm the scope, timing and fees before work begins.

Timing depends on the systems and scope involved, as well as access and scheduling. We’ll agree timing with you before work begins.

No. A penetration test is a point-in-time assessment of an agreed scope. It can identify and validate weaknesses found during that work, but it cannot establish that a system has no vulnerabilities.

Book a 30-minute call and bring the system or service you want to discuss, along with your goals and any relevant deadlines.