Remediation Tracking and Verification Testing

Marking a vulnerability as fixed does not mean it is fixed. A patch may not have reached every server, a configuration change may have left another path open, or a fix may only have addressed the symptom.

Verification testing removes that uncertainty and produces concrete evidence for both leadership and auditors.

• Remediation status of penetration test findings and the teams responsible
• Internal target closure times for critical findings
• Priority patching of actively exploited vulnerabilities, such as those in the CISA KEV catalog
• Whether findings with temporary workarounds have received a permanent fix

Verification is not just a one-time check; it is a measure of how well your patching process works. We recommend mapping findings to target closure times by severity and tracking how well those targets are met each period.

Vulnerabilities known to be actively exploited, or with a high likelihood of exploitation such as a high EPSS score, should be moved up even if their CVSS score is lower. Our tracking table shows this prioritization together with the responsible team and target date.

1. Finding review: we review the previous report's findings together with the fixes your team applied.
2. Retest: each finding is tested again using the method and conditions under which it was first identified.
3. Outcome: each finding is marked as closed, partially closed or open, with additional guidance where needed.
4. Reporting: the verification report uses finding IDs traceable to the original report.

• A verification report with per-finding results and evidence
• Updated remediation guidance for findings that remain open
• Optional closure-rate and mean-time-to-remediate metrics over time

It suits organizations that must document fixes after a penetration test, companies that need to show closure evidence to regulators and auditors, and IT teams that want to make their patching process measurable.