Veiltrack: facts for vetting a pentest vendor

Veiltrack is a Ukrainian cybersecurity company from Kyiv, led by its founder Vlad Kraevsky. We run penetration tests, vulnerability assessments and phishing simulations; this page collects short, honest answers to the questions a client asks a vendor before signing a contract, including what we do not have yet.

You can use this page together with our pentest vendor questionnaire: the questions are there, our answers to the main ones are here. How we work is described on the penetration testing page.

In short

Company and team

Legal. The contract is signed by FOP Kraievskyi Vladyslav Yuriiovych (Ukrainian sole proprietor). We are not VAT payers. There is no separate company (an LLC or a company in the EU) yet; when there is one, we will update this page.

Experience. The founder has worked in security since 2019. The team has worked on the security of many Ukrainian banks, as well as government bodies and law enforcement agencies. The founder has also taught a penetration testing course for a Ukrainian university.

Who actually tests. The founder leads every project and is responsible for the result. Depending on workload and the type of assessment, testing is done by him or by a team of engineers: vetted contractors we have worked with for years. In total, up to 5 people work on a project. Every participant works under NDA. The certifications of the founder and the team are listed on the about us page.

Do we sell anything besides testing. Yes, and we say so openly: through partners we help with GRC (policies, compliance), defensive solutions and Blue Team. Veiltrack's main focus is offensive security testing. Recommendations in the report do not oblige you to buy anything from us.

Methodology

We follow widely used standards: the OWASP Web Security Testing Guide for web applications and APIs, OWASP MASTG for mobile apps, PTES as the general pentest sequence, NIST SP 800-115 for planning and reporting, OSSTMM for operational security. ^{[1] [2] [3] [4] [5]}

How much is manual. It depends on the service, and we say it plainly:

• Vulnerability scanning. Mostly automated tools (for example, Nessus, Acunetix), but a specialist reviews the result and removes obvious noise.
• Vulnerability assessment. Scanning plus manual verification of every finding: whether it is real and how dangerous it is for you specifically.
• Penetration test. The core of the work is manual: the specialist acts as an attacker and checks logic, roles, authorization bypass and vulnerability chains. Automation only helps cover a large surface; a person makes the decisions.

Pentest stages. Agreeing on scope and rules, open source intelligence (OSINT), identifying available services, searching for vulnerabilities, manual verification, checking whether vulnerabilities can be exploited with the client's permission, the report and a walkthrough.

Tools. Burp Suite Professional, Nmap, Nessus, Acunetix, Metasploit, sqlmap, Kali Linux, plus our own and open source scripts. A tool does not replace the specialist: every finding in the report is verified by a person.

Production system or test copy. We can test either. On a production system we limit the load and do not run dangerous checks without the client's separate permission.

Client data

• NDA is always signed, before work starts.
• Storage. Project materials (evidence, notes, the report) are stored encrypted locally and in a Google cloud workspace.
• Deletion. After the work is finished, we delete the materials.
• AI tools. In our work we use AI assistants (Claude, ChatGPT, Gemini and others) to analyse and prepare materials. If you do not want your data to go to AI services, we work without them: this is agreed before the start.
• Report delivery. The report is delivered in an encrypted archive, with the password sent through a separate channel.

Report

The report contains:

• a short executive summary: what we found and what it means for the business;
• tables and charts of findings by risk level, colour coded;
• for each finding: category, CWE, CVSS score, technical description, evidence and screenshots ^{[6] [7]};
• the order of fixes and links to materials that will help developers close the issue.

After delivery we hold a final meeting and walk through the report. We show an anonymised sample report to a prospective client in person; we do not publish it.

Process and safety of the work

• Permission and scope. Scope, permitted actions and contacts are set out in the contract; before signing we discuss them with the client and add the client's terms.
• Communication. During testing the founder is always reachable: we set up a channel in a messenger that suits you, plus email.
• Critical findings are reported immediately, through a secure channel, with details in an encrypted archive, without waiting for the final report.
• Signs of a real breach. If during the work we see signs of a real attack, we notify the client as soon as possible, no later than within 24 hours.
• Stop on request. The client can stop testing at any moment: just write to us.

What we do not do without a separate agreement: DoS and DDoS tests, physical entry into premises.

Prices, timing, contract

• Price. A penetration test usually starts at $1,000. Vulnerability scanning can cost less, from a few hundred dollars, depending on scope. We name the exact amount after a short call, once the scope is clear. More in the article how much a pentest costs.
• Payment. 50% upfront and 50% after the report is delivered. For Ukrainian clients in hryvnia; for clients from abroad in dollars or euros.
• Timing. From the first call to the start usually takes from one to a few days; how long the work itself takes depends on scope.
• Liability. A pentest shows the state of security at the time of testing, within the agreed scope and time; it does not guarantee that there are no other vulnerabilities. Specific liability terms are set in the contract.
• Professional liability insurance we do not have as of today. Company certification (ISO 27001) we do not have either: we plan to come back to it after the company is registered.

Examples from the founder's experience

We do not disclose client names.

• Crypto exchange. We found a critical vulnerability that let a user change the exchange rate themselves, swap funds at a favourable rate and withdraw them from the exchange. In other words, the losses would have been counted not in days but in seconds.
• Phishing simulation at a large Ukrainian bank. More than 60% of employees clicked the link in the test email, and roughly one in three entered a login and password, often several times in a row. One login and password pair would have been enough for a breach.

FAQ

Who signs the contract on Veiltrack’s side?

FOP Kraievskyi Vladyslav Yuriiovych (Ukrainian sole proprietor). We are not VAT payers. The contract and NDA can be in Ukrainian or English.

Who physically does the testing?

The founder or a team of vetted engineers under his lead, all under NDA. The founder leads every project and is responsible for the result.

Is a retest included in the price?

It depends on the package. Some packages include a retest, in others it is ordered separately. This is visible in the commercial proposal before the contract is signed.

Do you use AI with client data?

Yes, AI assistants help with analysis and preparing the report. If you object, we work without them, and this is agreed before the start.

Do you have insurance and ISO 27001?

No, as of October 2026. We work as a FOP and say so honestly; we will come back to certification after the company is registered.

References

1. OWASP Web Security Testing Guide owasp.org
2. OWASP Mobile Application Security Testing Guide (MASTG) mas.owasp.org
3. Penetration Testing Execution Standard (PTES) pentest-standard.org
4. NIST SP 800-115: Technical Guide to Information Security Testing and Assessment csrc.nist.gov
5. ISECOM: OSSTMM 3 isecom.org
6. MITRE: Common Weakness Enumeration cwe.mitre.org
7. FIRST: Common Vulnerability Scoring System first.org