- Change after a penetration test
- Testing decisions
- Releases and change
- Assessment freshness
Change after a penetration test
How long is a penetration test valid, and what shortens it?
A penetration test report has no expiry date of its own. Who sets the period it stays valid for, which changes shorten it, and how to show a customer or auditor that it still describes production.
Hamad Alnakal · 11 min read
Testing decisions
What counts as a significant change for a penetration test?
PCI DSS, NIST, DORA and NIS2 tie penetration testing to significant change and leave the definition to the organisation. What each standard says, which changes usually count and how to record the decision.
Hamad Alnakal · 12 min readReleases and change
Change management evidence: checking approved changes against production
A change ticket records what a team intended to ship, and production shows what actually shipped. What ISO 27001, SOC 2, PCI DSS and DORA ask change management to prove, and how to check approved changes against production.
Hamad Alnakal · 11 min readChange after a penetration test
What happens to a penetration test report the day after delivery
A penetration test report describes the application as it stood during the test. This post covers what changes first, why teams miss it, and what to record so the report stays useful.
Hamad Alnakal · 8 min readAssessment freshness
How to tell how far production has moved since the last penetration test
Assessment freshness is how far production has moved since the last penetration test. How to check it from the outside, which changes count, and why a plain state serves teams better than a percentage.
Hamad Alnakal · 9 min readTesting decisions
Targeted testing or a full assessment: deciding from the evidence
After a production web application changes, your team has to decide whether it needs testing. A method for choosing between targeted testing and a full assessment, mapped to the OWASP testing guides.
Hamad Alnakal · 9 min read
Two posts a month after launch. RSS feed.
Book a demo
See how Vikax answers what changed since the test.
A guided walkthrough of monitoring, release review and testing decisions, with the team that built Vikax.