Lion Cipher Lab
Verify remediation and write a retest report
- Penetration Testing / Red Team
- Intermediate
- ~55 min
- Free · no account required
Why it matters
A penetration test's first report tells a client what is broken. It does not, by itself, make them any safer — the safety comes from fixing the findings, and the proof of safety comes from someone competent going back to confirm the fixes actually hold. That second visit is the retest, also called remediation verification, and it is quietly the highest-value deliverable in the whole engagement: it is what an auditor, a regulator, a cyber-insurer, or a board actually wants to see, because 'we were told to fix 14 things and here is independent proof that 12 are closed, 1 is partially closed,…
What you'll learn
- what a retest (remediation verification) is and why it closes the loop
- verification states: Resolved, Partially resolved, Not resolved, Risk accepted, Unable to verify
- proving a fix holds instead of trusting 'we fixed it'
- re-scoring residual risk after remediation
- writing a retest report a client and an auditor will accept
- building a remediation verification tracker
- the reporting phase of NIST SP 800-115 and OWASP WSTG
Steps in this lab
- What a retest is, and why 'we fixed it' is not evidence
- Gather the inputs: original findings, fix claims, and scope
- Define the verification states before you test
- Verify each finding and capture the evidence
- Re-score residual risk with CVSS
- Build the verification tracker
- Write the retest report, and the judgement that makes it trusted