FAQ
Questions, answered.
The things people usually ask before an engagement. Don’t see yours? Ask us directly.
What does Winternitz do?
Security engineering: post-quantum cryptography migration, cryptocurrency custody and signing infrastructure, smart-contract and cryptographic audits, penetration testing and red teaming, custom security-critical software, and fractional CTO work.
Who will actually do the work?
The people you talk to. Engagements are run in-house, and no subcontractors ever touch your environment.
How is pricing set?
Every engagement is scoped in writing first and quoted at a fixed price, so you know the cost before anything starts. The price depends on scope, size and deadlines.
How long does a penetration test take?
It depends on scope. A focused web application or API test is usually measured in weeks, not months; a full red-team engagement takes longer. You get a timeline in the written scope before work begins.
Do we really need to worry about quantum computers yet?
If your data must stay confidential for many years, yes. Attackers can record encrypted traffic today and decrypt it once a large quantum computer exists. Our quantum risk calculator shows whether your timeline is already a problem.
Will you sign an NDA before we share details?
Yes. We're happy to sign your NDA, or provide ours, before you share anything sensitive.
Do you work with clients outside Texas?
Yes. We're based in Texas and work with clients wherever they are; most work is done remotely.
How do I report a vulnerability in your own systems?
See our security policy at /security/ or the machine-readable contact details in /.well-known/security.txt. We acknowledge reports within three business days.
Have a system that has to hold?
Tell us what you're protecting and when it has to be ready. You'll get a straight answer on scope, timeline and price, usually within one business day.