Straight answers before you commit.
The things clients ask us most often about scope, timing and what a report actually contains. If yours is not here, ask directly.
Do you send automated scanner reports?
No. Every engagement is manual and researcher-led. We investigate, chain findings together and demonstrate real business impact, then explain how to fix it.
How long does testing take?
Most engagements run between one and four weeks, depending on scope, complexity and how easily the environment can be accessed. Timelines are agreed in the statement of work.
Can you test hardware as well as software?
Yes. Connected hardware is our centre of gravity: firmware, bootloaders, debug interfaces such as UART and JTAG, radios, update paths, companion apps and cloud services.
Do you support PCI DSS requirement 11?
Yes. We run annual and post-change penetration tests aligned to PCI DSS Requirement 11, covering the cardholder data environment, segmentation and connected systems.
What happens after the report is delivered?
We stay available for questions while your team remediates, then retest the identified issues so you have evidence that fixes actually hold.
Do you work outside Sydney?
We are Sydney-based, which supports physical testing, on-site work and direct collaboration. Remote testing is available for organisations elsewhere in Australia.
How do we start an engagement?
Book a 30-minute scoping call. We discuss the environment, recommend the most relevant testing approach and confirm whether we are the right fit before any commitment.
How do we purchase DVRPi?
DVRPi is designed by Exploit Security. The project repository remains public under GPL-3.0.
Still unsure? Email info@exploitsecurity.io and we will answer plainly.