Retesting & Validation
Verify your fixes work - get an updated report your auditors will accept
What this engagement covers
The service
Retesting is the critical final step that proves your remediation actually worked. Our engineers re-execute the original attack vectors against your updated environment, verify each fix blocks the vulnerability, and produce an updated report with pass/fail status for every finding. Auditors, compliance teams, and boards need proof - not promises.
What we test
We systematically retest every finding from the original assessment. This includes re-running exploit chains for critical and high-severity vulnerabilities, verifying authentication and authorization fixes, confirming infrastructure hardening changes, validating that new security controls are effective, and checking for regression issues introduced during remediation.
Scoping & Assessment Depth
Black Box Assessment
Zero-KnowledgeSimulates an external adversary targeting Retesting & Validation with no internal credentials, source code, or architecture documentation. Assesses perimeter exposure, unauthenticated attack paths, and edge resilience.
Gray Box Assessment (Recommended)
CredentialedSimulates an authenticated user, tenant, or insider threat within Retesting & Validation. We evaluate role segregation, authorization boundaries, privilege escalation, and business logic flaws across user tiers.
White Box / Source-Assisted
Full-KnowledgeConducted with direct access to architecture schematics, configuration files, and API/code documentation. Eliminates blind spots and provides exhaustive coverage of security mechanisms governing Retesting & Validation.
Attack Surface & Vulnerability Vectors
Incomplete remediation (partial fixes)
Rigorous testing and validation to uncover Incomplete remediation (partial fixes) across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Regression from code changes during fix
Rigorous testing and validation to uncover Regression from code changes during fix across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Bypass of newly implemented controls
Rigorous testing and validation to uncover Bypass of newly implemented controls across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Missing edge cases in authorization logic
Rigorous testing and validation to uncover Missing edge cases in authorization logic across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Inconsistent fix across environments
Rigorous testing and validation to uncover Inconsistent fix across environments across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
New dependencies introducing vulnerabilities
Rigorous testing and validation to uncover New dependencies introducing vulnerabilities across your Retesting & Validation environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
How we run it
We use the same tooling, techniques, and attack paths from the original engagement to ensure an apples-to-apples comparison. Each finding is re-attempted and marked as Resolved, Partially Resolved, or Unresolved. The updated report includes evidence screenshots, timeline comparisons, and a compliance attestation letter confirming the current state of your security posture.
Review original findings and remediation evidence
Rigorous technical execution, boundary verification, and manual exploitation testing targeting review original findings and remediation evidence across your retesting & validation deployment.
Re-execute exploit chains for each vulnerability
Rigorous technical execution, boundary verification, and manual exploitation testing targeting re-execute exploit chains for each vulnerability across your retesting & validation deployment.
Validate authentication and authorization fixes
Rigorous technical execution, boundary verification, and manual exploitation testing targeting validate authentication and authorization fixes across your retesting & validation deployment.
Test infrastructure and cloud hardening changes
Rigorous technical execution, boundary verification, and manual exploitation testing targeting test infrastructure and cloud hardening changes across your retesting & validation deployment.
Check for regression or newly introduced issues
Rigorous technical execution, boundary verification, and manual exploitation testing targeting check for regression or newly introduced issues across your retesting & validation deployment.
Verify security headers and TLS configuration
Rigorous technical execution, boundary verification, and manual exploitation testing targeting verify security headers and tls configuration across your retesting & validation deployment.
Confirm compliance control effectiveness
Rigorous technical execution, boundary verification, and manual exploitation testing targeting confirm compliance control effectiveness across your retesting & validation deployment.
Generate updated report with pass/fail status
Rigorous technical execution, boundary verification, and manual exploitation testing targeting generate updated report with pass/fail status across your retesting & validation deployment.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Updated pentest report with pass/fail per finding
- Evidence screenshots for each retest attempt
- Compliance attestation letter
- Regression testing results
- Risk delta analysis (before vs. after)
- Executive summary of remediation effectiveness
- Auditor-ready documentation package
- Recommendations for any remaining issues
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| SOC 2 Type II | CC4.1, CC7.1, CC7.2 | Technical testing evidence validating system boundaries, access restrictions, and vulnerability identification controls. |
| PCI DSS v4.0 | Requirement 11.4 & 11.4.3 | Adversary-driven external and internal penetration testing with application-layer validation and vulnerability remediation verification. |
| HIPAA Security Rule | 45 CFR § 164.308(a)(8) | Formal technical evaluation verifying the integrity of ePHI safeguards, network segmentation, and privileged access safeguards. |
| ISO/IEC 27001:2022 | Control A.8.8 & A.8.20 | Management of technical vulnerabilities and network security verification through independent technical assessments. |
| NIST Cybersecurity Framework | PR.AC, DE.CM, RS.AN | Technical testing verifying access controls, anomaly detection efficacy, and incident response mitigation capabilities. |
| CMMC 2.0 Level 2 / 3 | CA.L2-3.12.1, SC.L2-3.13.1 | Technical validation of Controlled Unclassified Information (CUI) protection, perimeter defense, and enclave isolation. |
| FedRAMP Rev 5 | CA-8 Penetration Testing | Independent technical penetration testing required for Cloud Service Provider (CSP) authorization and continuous monitoring. |
Findings are mapped to SOC 2, PCI-DSS, HIPAA, ISO 27001, NIST CSF, CMMC, FedRAMP, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
Our Retesting & Validation service combines deep manual testing with automated verification. We cover: Updated pentest report with pass/fail per finding, Evidence screenshots for each retest attempt, Compliance attestation letter, Regression testing results, Risk delta analysis (before vs. after). Every engagement includes reproducible proof-of-concept exploits, developer-ready remediation guidance, and a free retest.
Yes. Findings are directly mapped to SOC 2, PCI-DSS, HIPAA, ISO 27001, NIST CSF, CMMC, FedRAMP control requirements. The resulting report is auditor-ready and formatted for immediate submission to SOC 2 CPAs, PCI QSAs, and enterprise vendor risk assessment teams.
Yes. Every Lorikeet Security engagement includes free retesting within 30 to 60 days to validate that your remediation patches successfully resolve the identified vulnerabilities before your final report is issued.
Typical active testing turnaround is 3-5 days, with critical findings reported immediately via your Talon portal so your engineering team can begin remediation without waiting for the final PDF.
Pricing starts from $3,000. We scope the engagement in one call based on your environment's surface area, user roles, and complexity, providing a transparent, fixed-price quote with no hidden change orders.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
