What is Remediation & retest?
Confirming, after a fix is deployed, that the vulnerability is actually closed — and that the fix did not break something else.
Remediation & retest: Confirming, after a fix is deployed, that the vulnerability is actually closed — and that the fix did not break something else.
In plain language
Finding a bug is half the job; proving the fix worked is the other half. A retest re-runs the exact exploit against the patched system to confirm it fails now, and a regression check makes sure the fix did not open a new hole. Compliance regimes like PCI-DSS v4.0 explicitly expect this.
Because SuperPentest re-runs on every release and keeps replayable evidence, confirming a fix is a re-run, not a new engagement — the exploit that worked before should now fail, on the record. How findings are verified →
A concrete example
Engineering ships a fix for an IDOR on Friday and closes the ticket. The retest replays the exact original request on Monday — and it now returns 403 for the cross-account id, while the owner still gets 200. That pairing (exploit fails, legitimate use still works) is what “fixed” actually means. Because SuperPentest keeps the replayable evidence, the retest is a re-run, not a new engagement.
Related
Continuous pentesting → · How findings are verified →
Want this tested on your app? Book a demo or read how findings are verified.