An illustrative situation · 4 chapters
You shipped the fix. Did it resolve the pentest finding?
The report is in, and an engineer has shipped a fix. A closed ticket doesn't establish that the reported behavior is gone. Follow the finding into a scoped retest to check whether the issue is resolved.
Chapter 01
Agree which systems the pentest covers.
Start with the application and environment named in the original engagement. Your engineer has changed the affected code; now you need to check the behavior the tester reported. Confirm where that change is deployed before arranging a retest. A fix in a branch isn't a fix in the tested environment.
01 / Scope · the application and environment being assessed
Chapter 02
Work from the finding's technical detail.
Read the finding and remediation guidance in the published report. For a finding linked to a repository, inspect the matching code to understand the cause. An authorization failure, for example, needs investigation of the access check that allowed the request, beyond the severity label on the report.
02 / Finding · report detail and relevant source code
Chapter 03
Have engineering implement and test the fix.
Your engineering team decides how to address the cause and ships the change. For the authorization example, include a regression test for the request that should be denied. That gives the retest a specific change to examine and the team a test to keep after the engagement ends.
03 / Remediation · an engineering change ready for retesting
Chapter 04
Retest the affected behavior.
Clone the completed engagement into a new draft, then agree the retest scope with Sythe Labs. The follow-up assessment checks the fixes within that scope. Until testing has happened, the draft only records planned work; it doesn't close the original finding or establish that the fix worked.
04 / Retest · a separate assessment of the agreed fixes
What you leave with
The original pentest report and a separate engagement for checking the fixes.
Have a similar task on your team's list? Book a call to discuss how this workflow would fit your systems and who would need to be involved.