// Faq.jsx — accordion FAQ (offensive-only). Home page only, so in-page anchors are safe.
const FaqLink = ({ href, children }) => (
{children}
);
const QUESTIONS = [
{ q: 'How quickly can you start?', a: 'We reply within one business day and send a fixed-fee scope within 48 hours of the call. Kickoff is typically within four business days of signature; for pre-launch or audit-driven work we can start faster when the scope is clear.' },
{ q: 'Do you offer fixed-price or time-and-materials?', a: <>Fixed fee against a written scope, for every engagement (see pricing). Continuous Pentesting is a monthly subscription, and you control the testing backlog. },
{ q: 'What certifications does your team hold?', a: <>Every tester holds at least one OSCP-level certification. Across the team we hold OSCP, OSEP, OSWE, OSED, CRTO, CRTL, GXPN, GWAPT, GMOB, CCSP, CISSP, and CREST CCT, refreshed quarterly. The full list is in the certifications section. },
{ q: 'Will my findings be shared with anyone else?', a: 'No. Every engagement is covered by a mutual NDA. We never publish or reference client work without written permission, and anonymized statistics only appear in our write-ups with your consent.' },
{ q: 'Do you work with international clients?', a: 'Yes. We deliver engagements remotely worldwide, and we accommodate data-residency requirements for findings, evidence, and reports on request.' },
{ q: 'What does the free retest cover?', a: 'Within 90 days of report delivery we retest every High and Critical finding, plus a sample of Mediums. You receive a delta report (fixed, partially fixed, accepted risk) signed by the tester who ran the engagement, at no extra charge.' },
{ q: 'Can you support our compliance audit?', a: 'Yes. Reports map findings to ISO 27001, SOC 2, PCI DSS v4, HIPAA, GDPR, DORA, NIS2, CMMC, and RBI guidelines, and we join the attestation conversation with your auditor at no extra cost.' },
{ q: 'Do you exploit findings against production systems?', a: 'Only with written authorization, only where the scope allows, and only with reversible techniques. Destructive proofs of concept run on staging or isolated copies. Access to sensitive data is documented, never extracted.' },
{ q: 'How is red teaming different from a pentest?', a: <>A pentest looks for vulnerabilities in a defined system. A red team operation pursues a business objective by any in-scope route, including phishing, phone, physical, network, and cloud, to test how well your detection and response hold up. },
{ q: 'Will you trigger our EDR or SIEM during testing?', a: 'Sometimes, on purpose. For joint exercises we coordinate fully with your defenders. For stealth red team operations we move slowly and quietly so you can measure how much your tooling detects.' },
];
const Faq = () => {
const [open, setOpen] = React.useState(0);
return (
FAQ
Frequently asked questions
Have another question? Ask our team directly and we will reply within one business day.