Question 1

What exactly does a re-test verify?

Accepted Answer

A re-test re-checks the specific findings from the original assessment to confirm each one is actually fixed — not that the whole application is newly perfect. The output is a clear open-versus-closed picture for those issues.

Question 2

Is the re-test included in the original engagement price?

Accepted Answer

The productised one-time assessment includes a re-test, and re-running automated scan profiles against an engagement is part of the platform. A certified human re-test with attestation is the L4 consulting add-on — see the VAPT hub for how the layers fit.

Question 3

How much should we budget for the full find-fix-verify cycle?

Accepted Answer

Plan around the initial assessment, since verification re-runs are part of the platform. In the Indian market a focused web application penetration test typically costs ₹1.5–4 lakh (USD 2,000–5,000) and combined network + web VAPT for a mid-size environment ₹5–15 lakh (USD 6,000–18,000); Infronest engagements start at ₹36,750 per application per year, or ₹42,000 one-time, with the re-test included.

Question 4

How soon after fixing can we re-test, and how long does it take?

Accepted Answer

As soon as the fixes deploy — you trigger the re-run yourself. Because a re-test only re-checks previously reported findings, it completes in days rather than the one-to-three weeks typical of an initial scoped web assessment; a certified human re-validation is scheduled with the consulting team.

Question 5

How are fixes confirmed — automated re-scan or manual?

Accepted Answer

Both paths exist. Automated re-scans and the verification engine re-check reported issues for fast confirmation, and a human re-tester manually re-validates critical and high findings when an audit needs that assurance.

Question 6

What is a delta report and who is it for?

Accepted Answer

A delta report compares the current state to the previous assessment and lists what closed and what is still open, with evidence. It is built for auditors and clients who need proof that remediation actually happened.

Question 7

Do you issue a certificate or attestation after the re-test?

Accepted Answer

We can provide an executive attestation letter after a human re-test, describing what was validated. It is professional attestation of the testing performed — not an ISO, PCI or other compliance certification, which only an accredited body can grant.

Question 8

What happens to findings we believe are false positives?

Accepted Answer

They are not silently dropped. Closing a finding as a false positive requires a documented reason in the workflow, so the audit trail explains why every dismissed issue was dismissed.

Remediation support and retests that prove fixes held

What exactly does a re-test verify?

Included in the Infronest workspace

What you get

What teams can do here

How it works

Triage and assign

Fix with guidance

Verify the fixes

Issue a delta report

A worked example

Frequently asked questions

Prove the fixes actually landed

Remediation support and retests that prove fixes held

What exactly does a re-test verify?

Included in the Infronest workspace

What you get

What teams can do here

How it works

Triage and assign

Fix with guidance

Verify the fixes

Issue a delta report

A worked example

Frequently asked questions

All VAPT services

Web application vulnerability assessment & penetration testing

Mobile application security testing (APK / IPA)

API penetration testing for REST, GraphQL & microservices

Network penetration testing, internal and external

Cloud penetration testing for AWS, Azure and GCP

Continuous security scanning on every commit and deploy

Explore connected offerings

Web application vulnerability assessment & penetration testing

Mobile application security testing (APK / IPA)

Security and VAPT for IT teams

Prove the fixes actually landed