Overview
PCI DSS expects exploitable vulnerabilities found in a penetration test to be corrected and confirmed by retesting, and US auditors and enterprise customers look for the same proof elsewhere. We retest each fix against the original evidence, record its status, and issue a letter you can share. For reports from another provider, we quote the retest separately after reading the findings.
Remediation is where security testing either pays off or quietly fails. A fix can look complete in a ticket yet miss an edge case, address the symptom but not the cause, or introduce a new weakness while closing the old one. Retesting exists to replace the assumption that a fix worked with evidence that it did, by re-running the original issue against the updated system and confirming the behavior that proved it is genuinely gone.
We treat each finding individually rather than rescanning the whole scope. Working from the original evidence, we reproduce the conditions that demonstrated the issue and check whether they still hold, recording each as resolved, partially resolved or still present. Partial fixes are common and matter: a control added in one place but not another, or input handled on one path but not a parallel one, leaves real exposure that a simple pass or fail would hide, so we describe exactly what remains.
The value is an honest, independent record of your current state. Because we validate against the specific findings, the outcome is unambiguous, and once the material issues are resolved we issue an attestation letter stating what was retested and confirmed. This service stands on its own, retesting findings from an earlier engagement whoever produced them, and it is the natural close to any test we run, where retesting fixed findings is already included at no extra charge.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- IntakeWe take the original findings and evidence and confirm what is ready to retest.
- RetestingEach finding is reproduced individually against the updated system.
- ClassificationWe record resolved, partial and open status with supporting evidence.
- ReportingResults are documented clearly, including any remaining exposure.
- AttestationOnce material issues are closed, we issue a shareable attestation letter.
What you receive
- Per-finding retest results with evidence
- Clear resolved, partial or open status for each issue
- Description of any remaining exposure
- Notes on regressions introduced by fixes
- Attestation letter you can share with customers and auditors
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- CVSS v4.0
- CWE
- FTC Safeguards Rule
- NYDFS Part 500
- CMMC Level 2
Frequently asked questions
Can you retest findings from another provider?
Yes. This service is independent of who performed the original test. Give us the findings and their evidence and we will reproduce each one against your updated systems, which is often useful when you want a second, impartial confirmation that fixes hold.
What counts as a partial fix?
A fix that reduces but does not remove the exposure, for example a control added on one path but not a parallel one, or an input validated in one place but not another. We flag these explicitly, because a plain pass or fail would hide the real risk that remains.
Is retesting included in your other engagements?
Yes. Every test we run includes a free retest of fixed findings and an attestation letter. This standalone service is for retesting at a larger scale, validating another provider's findings, or revalidating long after the original engagement closed.
Which US rules call for annual penetration testing?
Among others: PCI DSS v4.0.1 Requirement 11.4; the FTC Safeguards Rule for covered non-bank financial institutions that don't run continuous monitoring; and NYDFS Part 500.5 for covered entities. HHS has proposed annual testing under HIPAA, but that rule is not final. Confirm which apply to you with counsel.
Can you act as our CMMC assessor or PCI QSA?
No. We don't claim QSA, ASV, C3PAO or RPO status. We run the penetration test and document it for whoever assesses you. If a requirement calls for an accredited body, raise it at scoping and we'll tell you plainly whether we can meet it.