Question 1

What is the difference between an AI pentest and a traditional pentest?

Accepted Answer

Traditional pentesting depends on the hours available and where a specialist decides to focus. That means sampling, not full coverage. The WYKYK AI Pentest uses AI to cover more ground, test more combinations and find connections that are easy to miss manually. Our cybersecurity specialists validate every finding and apply the business context that AI can't provide.

Question 2

Does the AI pentest replace a traditional pentest?

Accepted Answer

Yes. The WYKYK AI Pentest is a full pentest: scoped, human-led and delivered with a technical report and management summary. AI extends what our cybersecurity specialists can cover in the same time, making it broader and faster than a traditional approach. You don't need both.

Question 3

What is the difference between a pentest and a vulnerability scan?

Accepted Answer

A vulnerability scan checks your systems against a list of known issues. It shows what might be vulnerable, but not what is exploitable. A pentest goes further. Our cybersecurity specialists actively try to get in, find what is actually possible and show you the impact. Not a list of potential issues, but proof of what can be done.

Question 4

How long does a pentest take?

Accepted Answer

This depends on the scope and complexity of what is being tested. Most engagements deliver first results within 24 hours. The full report and management summary follow once all findings are validated.

Question 5

What happens to our data during a pentest?

Accepted Answer

A signed NDA is in place before anything starts. All findings are stored exclusively in the PenPortal, not in shared drives or external tools. AI tooling operates on private, zero-retention APIs, meaning your data does not train external models. Everything stays confidential.

Question 6

Can we define what gets tested?

Accepted Answer

Yes. Every pentest starts with a clear scope that we define together. We agree on what gets tested, how many hours are allocated and what the objectives are. Blackbox, greybox or whitebox, depending on how much access you want to provide.

Question 7

Is a pentest safe for our systems?

Accepted Answer

Yes. Every engagement starts with a clear scope and rules of engagement. We agree on what can and cannot be tested, ensuring there is no disruption to your operations. All actions are controlled and documented in the PenPortal.

Question 8

What do we receive at the end?

Accepted Answer

Every engagement ends with two documents: a detailed technical report and a management summary. All findings are logged in the PenPortal with evidence of how access was gained. Once fixes are deployed, your team can request a retest directly in the PenPortal to confirm issues are resolved.

Question 9

How often should you run a pentest?

Accepted Answer

Most organisations run a pentest at least once a year, often as part of compliance requirements like ISO certification. But digital environments change constantly. New features, integrations and code changes introduce new risks. If you ship software regularly, consider continuous pentesting to keep security aligned with your development pace.

Prove your security holds with offensive pentesting

See exactly how far someone can get

How it works

Why WYKYK

What can be done in your systems that shouldn't be possible?

Thiery Ketz