Penetration testing
Penetration testing with a retest
Testing follows paths an attacker would use and stays on the paths that matter. After findings are corrected in the environment you run, the same paths are tested again. A finding without a retest stays open in the written account. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Test, correct, retest
Penetration testing with retest is a defined cycle. The first test records which paths succeed, which alerts arrive, and which owner is supposed to act. Remediation is then done in the environment you run. The retest walks the same paths and records what is closed and what is still open.
We do not hand you a scanner listing and call it a test. The record shows which controls fail, which signals arrive late, and where ownership is unclear before an incident sets the timeline.
Readiness here is configurations, logs, tickets, restoration tests, and retest results. We record what held, what failed, and what changed.
The scope before the window
The scope is agreed before the test: systems, hours, and the people who can approve activity during the window. We work around your normal operations, and we'll need access to the right areas and the right people while we do. We need those people while the test and the retest are underway.
You can decline the scope. We do not start a window on a substitute list of systems and call it the same test.
This is for an organization that wants the test tied to ISO 27001 readiness, not a list of output with no owner. Identity, network, cloud, and endpoint controls are examined as one posture, because a path often crosses more than one of them. See security architecture.
What the test is for
Security operations on this practice means the alert has a destination. The people who watch alerts, the people who run the systems, and leadership use the same account of what the alert means and who decides. If that chain stops, the written account says where it stops.
Paths that succeed because of an exposed management plane, a flat network, or a recovery system no one can operate are written into the same account as the infrastructure review. The retest checks those paths after the correction.
REKKY Sec Ops Consulting does not issue an ISO/IEC 27001 certificate. Readiness and the retest record are what this engagement delivers.
What this is not
This is not a surprise attack on production, and it is not a 24-hour incident retainer. The window is written down. If an incident is already underway, say so. This test is the wrong engagement.
We do not grade you against a product list. We record the paths that worked and the owner who was supposed to see them.
Implementation after the findings is a separate scope. Once you approve it, we'll need access to the right areas and people.
Questions
What does penetration testing with retest mean?
Testing follows paths an attacker would use and stays on the paths that matter. After findings are corrected, the same paths are tested again until the findings are closed. A finding without a retest stays open in the written account.
What do you need during the test?
A written scope: systems, hours, and the people who can approve activity during the window. We work around your normal operations, and we'll need access to the right areas and the right people while we do. We cannot run the retest against a system your people cannot change.
Contact
Task us with the systems you want tested.
Name the paths that matter. We will write the window before anyone starts. We work around your normal operations, and we'll need access to the right areas and the right people while we do.