Penetration Testing & Vulnerability Management

An internet-facing system may have many scanner findings, but urgency depends on reachable attack paths, exploitability, data impact, and existing controls. Treating every finding equally can delay fixes that matter most. What to check Confirm asset ownership, exposure, vulnerable component, exploit availability, authentication requirements, business...

A rewritten application may remove old vulnerable code but introduce new routes or behavior. Closing findings based only on a different version number does not confirm the original weakness is gone. What to check Map the finding to the new route and component, reproduce the original test within authorized scope, and review changed authentication, input...

An application fix may reach the web interface while older mobile builds continue using a vulnerable API path. A server-side scanner alone may not reflect all client versions still in active use. What to check Inventory supported app versions and API routes, confirm the patch is enforced server-side where possible, and test authorized workflows across...

A development or diagnostic endpoint may remain accessible after its intended temporary use ends. Removing a link from the interface does not confirm that the route or API is no longer reachable. What to check Check authorized routes, DNS and host mappings, access logs, authentication, deployment configuration, and environment-specific feature flags....

A vulnerability may only be reachable under a particular role or permission combination. Retesting as an administrator can miss authorization flaws affecting ordinary users. What to check Identify affected roles, resources, and trust boundaries. Recreate authorized test accounts for each relevant role and verify both allowed and disallowed actions...

An API may expose multiple versions, deprecated routes, or alternate hostnames. Fixing the current endpoint does not close the weakness if an older version remains reachable. What to check Inventory versions and routes from code, gateway configuration, documentation, and traffic logs. Re-test the same authorized scenario across supported and legacy...

A CDN can cache vulnerable content, change headers, or block a test request before it reaches the application. A scan may report a fix or failure based on edge behavior rather than the origin application. What to check Compare authorized tests at the public edge and origin where in scope, inspect cache status, response headers, rules, and deployed...

A security issue may depend on an identity provider, proxy, or authentication broker rather than local application code. Fixing one layer may leave alternate login paths or direct endpoints exposed. What to check Map every authentication path, callback, token validation rule, direct endpoint, and provider configuration. Retest authorized scenarios with...