阅读中文版本

Penetration Test Remediation Workflow

Triage penetration test findings, fix exploitable issues first, and retest to confirm the fixes hold.

Overview

Remediate penetration test findings by exploitability and confirm fixes with retest.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• A penetration test report
• An issue tracker
• A retest capability

Procedure

1. Triage findings by exploitability

Rank findings by ease of exploitation and impact rather than CVSS alone.

Expected state: Findings are ordered by real risk.

2. Fix the exploitable issues

Remediate the highest-exploitability findings and add tests where possible.

Expected state: The easiest paths in are closed.

3. Address root patterns

Fix classes of issues, not just individual instances.

Expected state: The same mistake does not recur elsewhere.

4. Retest to confirm

Have the issues retested and confirm the exploit no longer works.

Expected state: Remediation is verified, not assumed.

# retest a previously exploitable endpoint
curl -s -o /dev/null -w '%{http_code}' https://app.example.com/admin || echo blocked

Verification

Confirm high-exploitability findings are fixed, the exploit fails on retest, and root patterns are addressed.

Decision points

Fix by CVSS or by exploitability?

• By exploitability and impact
• By CVSS score

Recommendation: Prioritise by how easily the issue can actually be exploited.

Fix instances or classes?

• Fix the class
• Fix each instance

Recommendation: Fix the class to prevent the same flaw elsewhere.

Common failures

• Fixing by CVSS ignores easier high-impact paths.
• Instance-only fixes leave the class open.
• No retest means the fix is assumed not proven.