Question 1

What services does Faseel offer?

Accepted Answer

Faseel is a full-spectrum cybersecurity company. We deliver penetration testing (VAPT), red team and adversarial simulation, blue-team defense (detection, response, and hardening), and GRC / compliance advisory. We also build three products: Komply (multi-framework compliance), Scout (a free external security scan), and Faseel Suite (an enterprise penetration-testing platform).

Question 2

Do you sign an NDA, and how is our data protected?

Accepted Answer

Yes — we sign an NDA before any engagement. We test only within your authorized scope, access the minimum needed to prove a finding, never exfiltrate real customer data, and deliver findings encrypted to named stakeholders only. Confidentiality is the default, not an add-on.

Question 3

Who actually performs the work — are they qualified?

Accepted Answer

Real, credentialed researchers — not a scanner with a logo. Our team holds hands-on credentials (Hack The Box CPTS, PortSwigger) and brings 50+ responsibly disclosed vulnerabilities and 13+ triaged HackerOne reports against real companies. You get manual, human-driven testing that finds business-logic and chained flaws automated tools miss.

Question 4

How much do your services cost?

Accepted Answer

Every engagement is scoped to your environment, objectives, and risk, so pricing is quoted per project rather than fixed. Scout (our external scanner) is free; Komply starts free and scales by plan; and services and Faseel Suite are quoted after a short scoping call. Contact us for a quote.

Question 5

Do you work with companies in the Gulf and Pakistan?

Accepted Answer

Yes — the Gulf and Pakistan are our home markets and our differentiator. We support Saudi NCA ECC, UAE Information Assurance, and Pakistani regulations (CTDISR, PDPB) that global vendors ignore, alongside international standards, and we serve clients worldwide.

Question 6

How do we get started?

Accepted Answer

Reach out via the contact page or run a free Scout scan first. We'll set up a short scoping call to define objectives, scope, and timing, then send a proposal. From there we schedule the engagement and get moving.

Question 7

Will your testing disrupt our production systems?

Accepted Answer

We take care to avoid disruption. Testing runs during agreed windows, sensitive or high-risk checks can be run against staging first, and destructive actions are never taken. You stay in control of scope and scheduling throughout.

Question 8

Do you provide reports we can show auditors and customers?

Accepted Answer

Yes. Every engagement ends with a professional report: an executive summary, detailed findings with risk ratings, clear remediation guidance, and evidence — formatted so you can hand it to leadership, customers, or auditors.

Question 9

What is VAPT?

Accepted Answer

VAPT stands for Vulnerability Assessment and Penetration Testing. The vulnerability assessment finds and lists weaknesses; the penetration test then safely exploits them to prove real-world impact. Together they tell you not just what's wrong, but what an attacker could actually do with it.

Question 10

What's the difference between VAPT and a vulnerability scan?

Accepted Answer

A vulnerability scan is automated and produces a list of potential issues, often with false positives. VAPT adds a human who validates each issue, chains flaws together, abuses business logic, and demonstrates real impact. A scan tells you what might be wrong; a penetration test proves what is.

Question 11

What types of penetration testing do you offer?

Accepted Answer

Web application, API (REST and GraphQL), mobile app (Android and iOS), network and infrastructure, and cloud (AWS, Azure, GCP) penetration testing — plus social engineering and wireless as part of broader engagements.

Question 12

How long does a penetration test take?

Accepted Answer

Most engagements run one to four weeks depending on scope. A focused web-app test is often one to two weeks; a comprehensive multi-target assessment can take three to four. We confirm the timeline during scoping.

Question 13

What methodology do you follow?

Accepted Answer

Our testing aligns to industry standards — PTES and the OWASP testing guides (including the OWASP Top 10 and API Top 10) — combined with a proprietary five-phase methodology: scope, reconnaissance, testing, exploitation, and reporting with a retest.

Question 14

Do you offer black-box, grey-box, or white-box testing?

Accepted Answer

All three. Black-box simulates an outside attacker with no prior knowledge; grey-box gives us limited access or credentials to test as a low-privileged user; white-box includes full information and source access for the deepest coverage. We recommend the right mix for your goals.

Question 15

How is a penetration test different from a red team engagement?

Accepted Answer

A penetration test finds and proves as many vulnerabilities as possible in a defined scope. A red team simulates a real adversary pursuing a specific objective across your people, processes, and technology — testing whether you'd detect and respond, not just whether a bug exists.

Question 16

Do you re-test after we fix the findings?

Accepted Answer

Yes. Remediation re-testing is included: once you've fixed the issues, we verify the fixes actually hold and issue an updated report, so you have a clean result to show customers and auditors.

Question 17

Can you test to satisfy a compliance requirement?

Accepted Answer

Yes. We regularly run penetration tests to satisfy ISO 27001, SOC 2, PCI-DSS, and regional requirements (NCA, UAE IA), and format the report as the evidence your auditor expects.

Question 18

How often should we run a penetration test?

Accepted Answer

At least annually, and after any significant change — a major release, new infrastructure, or a new product. Many teams combine an annual pentest with continuous automated scanning (via Faseel Suite) between engagements.

Question 19

What is a red team engagement?

Accepted Answer

A red team emulates a real, determined adversary end to end — chaining initial access, persistence, lateral movement, and objective completion across technical exploitation, social engineering, and even physical access — to test whether your people, processes, and technology would actually detect and stop an attack.

Question 20

How long does a red team engagement take?

Accepted Answer

Meaningful red teaming takes time: roughly four weeks for external-only and six to eight weeks for full-scope, because a patient, covert adversary can't be simulated in a few days. We scope duration to your objectives and threat model.

Question 21

Do we need a mature SOC before red teaming?

Accepted Answer

Red teaming is most valuable if you already have detection and response capability to test. If your detection is still maturing, a purple-team engagement usually delivers more value — it builds and validates detections collaboratively rather than just proving they're missing.

Question 22

What is purple teaming, and do you offer it?

Accepted Answer

Purple teaming runs our red team and your defenders (blue team) together, iterating in real time so detections are built and validated as we go. We offer both classic covert red teaming and collaborative purple-team engagements.

Question 23

Do you map findings to MITRE ATT&CK?

Accepted Answer

Yes. Every technique we use is mapped to the MITRE ATT&CK framework, so you get a clear, framework-aligned view of your detection coverage and gaps — not just a list of what we did.

Question 24

Will our internal security team know the test is happening?

Accepted Answer

That's your call. A covert engagement (blue team unaware) tests real-world detection and response; a collaborative or announced engagement focuses on improving defenses quickly. We support both and agree the approach with you up front.

Question 25

Can you emulate a specific threat actor?

Accepted Answer

Yes. We can model our tactics, techniques, and procedures after threat actors relevant to your industry — from cybercriminal crews to nation-state-style operators — using threat-led approaches similar to TIBER-EU and CBEST.

Question 26

What is blue-team / defensive security?

Accepted Answer

The blue team is the defensive side: building and tuning detection, hunting for threats already inside your environment, responding to incidents, and hardening systems so the next attack has nowhere to go. Where our red team shows how you'd be breached, the blue team makes sure you'd see it and stop it.

Question 27

Do you provide 24/7 monitoring or a SOC?

Accepted Answer

We scope monitoring and response coverage to your needs and risk — from business-hours support to continuous coverage — and help you build or tune the detection stack (SIEM/EDR) behind it. We'll recommend the right level during scoping.

Question 28

Can you help during an active security incident?

Accepted Answer

Yes. We provide incident response to contain, investigate, and recover from an active incident, then help you close the gaps that allowed it and improve detection so it doesn't happen again.

Question 29

What is threat hunting?

Accepted Answer

Threat hunting proactively searches your environment for signs of an attacker who may already be inside — rather than waiting for an alert. It reduces attacker dwell time and surfaces gaps your automated tools miss.

Question 30

How is blue team different from red team?

Accepted Answer

Red team attacks to find how you'd be breached; blue team defends — detecting, responding to, and hardening against those attacks. Run together as a purple-team exercise, each makes the other sharper.

Question 31

Can you improve our detection after a red team test?

Accepted Answer

Absolutely — that's one of the highest-value things we do. We turn red-team findings into a prioritized, evidence-based detection-improvement plan your blue team can act on immediately, and validate the new detections together.

Question 32

What is GRC?

Accepted Answer

GRC stands for Governance, Risk, and Compliance — running security as a managed program rather than ad-hoc. Governance sets policy and accountability; risk means identifying and treating what could go wrong; compliance means meeting the standards and regulations you're held to. Faseel covers all three, with Komply as the platform that ties them together.

Question 33

What is an ISMS?

Accepted Answer

An Information Security Management System is the documented set of policies, processes, roles, and controls that runs your security program — the core of ISO 27001. Komply builds and maintains your ISMS (context, objectives, roles, measurements) so it stays audit-ready.

Question 34

What's the difference between being compliant and being secure?

Accepted Answer

Compliance proves you meet a standard on paper; security is whether you'd actually withstand an attack. They overlap but aren't the same — which is why we pair compliance advisory with real penetration testing, so your certificate reflects genuine security.

Question 35

Can you help us choose the right framework?

Accepted Answer

Yes. In a short scoping call we map your customers, markets, and obligations to the right standard(s) — SOC 2 for US buyers, ISO 27001 for global, NCA ECC and UAE IA for the Gulf, GDPR where you handle EU data — and sequence them so shared controls are only done once.

Question 36

What is a gap analysis?

Accepted Answer

A gap analysis compares your current state against a framework's requirements to show exactly what's missing before an audit. It's usually the first step, and Komply's Stage 1 readiness self-check gives you a red/green view of it.

Question 37

What is a risk assessment and a risk register?

Accepted Answer

A risk assessment identifies threats to your information and rates their likelihood and impact; the risk register tracks each risk and how you're treating it. Both are required by ISO 27001 and built into Komply's risk module.

Question 38

What's the difference between SOC 2 Type I and Type II?

Accepted Answer

Type I checks whether your controls are designed correctly at a single point in time; Type II tests whether they actually operated effectively over a period (usually 3–12 months). Type II is more rigorous and is what most enterprise customers ask to see.

Question 39

Which frameworks do you support?

Accepted Answer

ISO/IEC 27001, ISO/IEC 42001 (AI), SOC 2, Saudi NCA ECC, UAE Information Assurance, GDPR, NIS2, UK Cyber Essentials and Cyber Essentials Plus, PCI-DSS, and Pakistan's CTDISR and PDPB — with cross-framework control mapping so you comply once and certify many.

Question 40

ISO 27001 or SOC 2 — which one do we need?

Accepted Answer

SOC 2 is usually expected by North American (US) customers and is common for SaaS; ISO 27001 is the internationally recognized standard, often needed for European and global markets. Many companies pursue both — and because roughly 70% of their controls overlap, adding the second typically costs far less than the first.

Question 41

How long does it take to get certified?

Accepted Answer

From scratch, ISO 27001 and SOC 2 typically take 6 to 12 months from gap assessment to audit; using a platform with readiness support often compresses that to 6 to 9 months. Komply's guided intake, AI-assisted drafting, and Stage 1 readiness check remove the slowest parts.

Question 42

Do I need a consultant, or can Komply do it?

Accepted Answer

Komply is designed so an in-house compliance manager can drive certification with guided intake, AI-assisted policy drafting, and a red/green readiness gate. For teams that want hands-on help, our advisory service works alongside the platform — and consultants get a dedicated Komply tier for managing multiple clients.

Question 43

Can we work toward multiple frameworks at once?

Accepted Answer

Yes — that's the core idea. Komply maps a single control set across many frameworks, so evidence you collect for ISO 27001 also counts toward SOC 2, NCA, UAE IA and more. Do the work once, certify many.

Question 44

What is a Statement of Applicability (SoA)?

Accepted Answer

The SoA is the document that lists every control, whether it applies to you, and why — the backbone of an ISO 27001 audit. Komply builds and maintains it for you, with AI-assisted justifications that a human reviews.

Question 45

Do you cover the Gulf frameworks like NCA and UAE IA?

Accepted Answer

Yes — this is our regional edge. Saudi NCA ECC and UAE Information Assurance are first-class in both our advisory work and Komply, mapped natively alongside ISO 27001 so one control effort satisfies your local regulator and international auditors.

Question 46

How much does compliance cost?

Accepted Answer

It depends on framework, scope, and how much is already in place. Komply starts free and scales by plan; advisory is quoted per engagement. We'll give you a clear picture during a short scoping call.

Question 47

Do you provide the auditor, or just get us ready?

Accepted Answer

Certification audits must be performed by an independent, accredited body, so we don't audit and certify you ourselves — that would be a conflict of interest. We get you fully audit-ready and support you through the audit; you can bring your own auditor or we can point you to a reputable one.

Question 48

What evidence will an auditor ask for?

Accepted Answer

Your policies, the Statement of Applicability, risk assessment and treatment records, and proof that controls actually operate — logs, tickets, configurations, and review records. Komply collects and organizes this and exports a one-click, auditor-ready package.

Question 49

How do you keep us compliant after we're certified?

Accepted Answer

Certification isn't one-and-done — standards require continuous monitoring, periodic reviews, and surveillance audits. Komply's continuous monitoring and built-in vulnerability scanning keep your evidence fresh so you stay certified year over year.

Question 50

Does GDPR apply to us if we're not in the EU?

Accepted Answer

Often yes. GDPR applies to any organization that handles the personal data of people in the EU, regardless of where you're based. If you have EU users or customers, it likely applies — and Komply supports GDPR readiness alongside your other frameworks.

Question 51

What is ISO 42001, and do we need AI compliance?

Accepted Answer

ISO/IEC 42001 is the management-system standard for governing artificial intelligence responsibly. If you build or deploy AI, it's increasingly requested alongside ISO 27001 — and Komply keeps the AI-governance records it requires.

Question 52

Do NIS2, PCI-DSS, or Cyber Essentials apply to us?

Accepted Answer

It depends on your sector and data. NIS2 raises cyber obligations for essential and important entities in the EU; PCI-DSS applies to anyone handling payment-card data; UK Cyber Essentials is a baseline often required to win UK public-sector contracts. We'll tell you which apply during scoping, and Komply maps all of them.

Question 53

What is Scout, and is it really free?

Accepted Answer

Scout is a free external security scanner. Enter your domain and a work email, and it shows what an attacker can see about your business — certificates, email spoofing, exposed files, hidden subdomains, breach history and more — in under 10 minutes. No account, no credit card.

Question 54

What is Faseel Suite, and how is it different from a scanner?

Accepted Answer

Faseel Suite is an enterprise platform that actively attacks your systems the way a red team would — SQL injection, authentication attacks, API testing, privilege escalation, business-logic flaws — and delivers a professional penetration-test report in hours, with CI/CD integration and team dashboards. A scanner only detects; Suite exploits and proves impact.

Question 55

What is Komply?

Accepted Answer

Komply is a multi-framework compliance / ISMS / GRC platform. It maps one control set across 10+ frameworks, drafts your policies and Statement of Applicability with human-reviewed AI, tracks risk and evidence, and exports an auditor-ready package. Comply once, certify many.

Cybersecurity questions, answered

Working with Faseel

Penetration Testing & VAPT

Red Teaming & Adversarial Simulation

Blue Team & Defensive Security

GRC & Compliance

Our Products

Still have a question?

Cybersecurity questions, answered

Working with Faseel

Penetration Testing & VAPT

Red Teaming & Adversarial Simulation

Blue Team & Defensive Security

GRC & Compliance

Our Products

Still have a question?

Cybersecurity questions, answered

Working with Faseel

Penetration Testing & VAPT

Red Teaming & Adversarial Simulation

Blue Team & Defensive Security

GRC & Compliance

Our Products

Still have a question?