Penetration Testing & Vulnerability Management

A firewall change may close one network path while leaving alternate interfaces, IPv6, or a different security group exposed. Checks to make Use the authorized original scope, confirm the changed rule and asset, test relevant reachable paths safely, and compare evidence with the original finding. Record residual access and avoid scanning provider...

A business may not control the code or patch schedule for a vulnerable vendor component. Checks to make Confirm vendor advisory and affected versions, identify where the component is used, request a timeline, and apply supported mitigations or exposure limits. Assign an internal risk owner and reassess when vendor evidence or threat conditions change....

An asset may have a public address but still be restricted by network policy, authentication, or service configuration. Checks to make Confirm the asset is in authorized scope, inspect public IP and firewall rules, verify DNS and routing, and test only expected service ports using agreed methods. Record both network reachability and application-level...

Patch validation must confirm the intended fix while staying within the asset and method boundaries that were authorized. Checks to make Recheck the exact in-scope asset and version, use a safe targeted validation, and compare results with the original evidence. Stop if DNS or ownership resolves to an out-of-scope system and document limitations rather...

Findings can be marked complete when a ticket closes even though the affected system remains vulnerable. Checks to make Record asset, evidence, severity rationale, owner, remediation plan, and target date. Require retest evidence or an approved risk decision before closure, and keep accepted exceptions time-bound with a review trigger. When to get...

Load balancing can send validation requests to different application versions or nodes with inconsistent configuration. Checks to make Confirm authorization and scope, record response node or version metadata where available, repeat safe checks across the intended pool, and compare configuration. Coordinate with service owners to avoid disruptive...

A CDN may cache responses or mask origin behavior, making it unclear whether a fix reached every relevant component. Checks to make Confirm the authorized test scope and origin ownership, identify cached versus dynamic routes, and validate the deployed version through approved methods. Coordinate cache invalidation and test edge behavior without...

Public APIs may expose sensitive operations even when individual findings have moderate technical severity. Checks to make Map each issue to endpoints, required authorization, affected data, abuse potential, and compensating controls. Validate high-impact paths within authorization, group related findings, and sequence fixes by reachable business...