Penetration Testing & Vulnerability Management

A CDN can cache vulnerable content, change headers, or block a test request before it reaches the application. A scan may report a fix or failure based on edge behavior rather than the origin application. What to check Compare authorized tests at the public edge and origin where in scope, inspect cache status, response headers, rules, and deployed...

A security issue may depend on an identity provider, proxy, or authentication broker rather than local application code. Fixing one layer may leave alternate login paths or direct endpoints exposed. What to check Map every authentication path, callback, token validation rule, direct endpoint, and provider configuration. Retest authorized scenarios with...

A mobile app update may not reach every user quickly, and older clients can continue calling vulnerable API routes. Fixing the visible app interface alone may leave the server-side weakness exposed. What to check Identify affected API versions, client release adoption, server-side authorization, direct route access, and request patterns. Test with...

A fix may reach one load balancer or region while another continues to expose the vulnerable route. A single successful retest may reflect only one traffic path. What to check Inventory public and internal load balancers, DNS targets, regions, listeners, backend versions, and health checks. Test authorized paths directly and through normal DNS routing....

A legacy endpoint may remain accessible after a new route is fixed. Clients, integrations, or old bookmarks can continue using the vulnerable path. What to check Inventory route versions from source, gateway, documentation, and access logs. Retest the original condition on both current and legacy endpoints within authorized scope. Recommended next...

A scanner may report a vulnerable package that is not visible in the expected operating-system package list. The finding can relate to a container image, bundled library, stale inventory, or version mapping. What to check Confirm the asset and scan timestamp, identify whether the finding is host or image based, inspect the package path and software...

A software update may be installed while a vulnerable service remains exposed through an old instance, alternate port, or cached container image. A closed ticket alone does not confirm risk reduction. What to check Identify every affected asset and entry point, confirm deployed versions, and repeat a safe validation using the original finding...

A new subdomain can expose a different application, vendor service, or administrative interface. Testing without clear ownership and authorization can disrupt systems outside the intended scope. What to check Confirm DNS target, service owner, data sensitivity, hosting provider, authentication requirements, and written authorization. Identify excluded...