Frequently asked questions
Answers about working with Black Fox Security: NDAs, contract types, testing methodologies and guidelines, frameworks and certificates.
13 questions
Engagements
How work with Black Fox starts, how it is contracted and what you receive.
Do you work with non-disclosure agreements?
Yes. We are strict on confidentiality and we respect your company's image. We can sign an NDA even before the first meeting; e-mail it to us beforehand at contact@blackfox-security.com.
What contract types do you work with?
Every company has its own procedures and requirements, so we are flexible: fixed-price contracts (FFP, FPIF, FP-EPA), cost-reimbursable contracts (CPFF, CPIF, CPAF, CPPC) and time and materials.
How does an engagement start?
With a kickoff meeting, online or in person, to understand your requirements, constraints and expectations. We then send a business proposal tailored to the project. The work starts once you approve it.
What do we receive at the end?
Whatever we agreed at the start: typically recommendations, a business report with a risk assessment, and a technical report with proofs of concept. We present the results in a handover meeting if you want one, and ask for your feedback before closing the project.
Which languages do you work in?
English, German and French.
How long does an engagement take?
It depends on the scope and on how quickly we get access and answers. The proposal comes with a dated plan rather than a guess.
Testing
Methodologies, guidelines and the rules a test runs under.
What is the difference between black, grey and white box testing?
A black box test starts with no prior knowledge of the target, like an outside attacker. A grey box test starts with the knowledge of a user, sometimes with elevated privileges, for a more focused effort. A white box test has access to everything, including source code, and gives the most complete picture. We adapt to your requirements.
Which testing frameworks and guidelines can you follow?
Whichever your project or your auditor asks for, among others MITRE ATT&CK, the OWASP guides (WSTG, ASVS, MASVS and MASTG), PTES, OSSTMM, ISSAF, NIST SP 800-115 and the PCI DSS penetration testing guidance. Tell us in the scoping call and the report follows its structure and terms. If nothing specific is required, we use our own methodology, FoxHunt.
What is FoxHunt?
FoxHunt is Black Fox's own testing methodology, used whenever a project does not prescribe one. It combines what the public frameworks do well with our own playbooks, and it is built for three things: getting the most out of the time an engagement has, making every finding reproducible with the steps and evidence to confirm it and its fix, and mapping each result to the requirements of the standards and regulations you report against, such as ISO/IEC 27001, SOC 2, PCI DSS, NIS2 or DORA, so the report also serves as audit evidence. Findings are also mapped to MITRE ATT&CK where it helps your defenders.
Compliance and certificates
Frameworks, certification and what a Black Fox certificate means.
Which security frameworks do you work with?
ISO standards, NIST, COBIT and PSR among others, and we adapt our tests and audits to GDPR, HIPAA or HISO where needed. The services page lists every framework and regulation with its own page.
Can Black Fox certify us?
No. Certificates for standards such as ISO/IEC 27001 are issued by accredited certification bodies, SOC reports by licensed CPA firms, and PCI DSS assessments by qualified assessors. We work with long-standing certification partners and coordinate the audit with them or with a body of your choice, so you go from gap analysis to the official certificate in one engagement, and we help you keep the result.
What is a Black Fox certificate of engagement?
A record that an engagement, such as a penetration test or an audit, was completed with us. Anyone can check it on the Verify page with its ID. It is not a compliance certification; the official certificate comes from the certification body.