Overview
A report full of open findings is a weak document to hand a UK auditor, insurer or enterprise customer. A retest turns it into proof of action. We re-run the original test steps against each fixed issue, mark it closed, partly fixed or still open, and issue a dated letter summarising the result. Retesting is free for engagements we delivered.
Remediation is where security testing either pays off or quietly fails. A fix can look complete in a ticket yet miss an edge case, address the symptom but not the cause, or introduce a new weakness while closing the old one. Retesting exists to replace the assumption that a fix worked with evidence that it did, by re-running the original issue against the updated system and confirming the behaviour that proved it is really gone.
We treat each finding individually rather than rescanning the whole scope. Working from the original evidence, we reproduce the conditions that demonstrated the issue and check whether they still hold, recording each as resolved, partially resolved or still present. Partial fixes are common and matter: a control added in one place but not another, or input handled on one path but not a parallel one, leaves real exposure that a simple pass or fail would hide, so we describe exactly what remains.
The value is an honest, independent record of your current state. Because we validate against the specific findings, the outcome is unambiguous, and once the material issues are resolved we issue an attestation letter stating what was retested and confirmed. This service stands on its own, retesting findings from an earlier engagement whoever produced them, and it is the natural close to any test we run, where retesting fixed findings is already included at no extra charge.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- IntakeWe take the original findings and evidence and confirm what is ready to retest.
- RetestingEach finding is reproduced individually against the updated system.
- ClassificationWe record resolved, partial and open status with supporting evidence.
- ReportingResults are documented clearly, including any remaining exposure.
- AttestationOnce material issues are closed, we issue a shareable attestation letter.
What you receive
- Per-finding retest results with evidence
- Clear resolved, partial or open status for each issue
- Description of any remaining exposure
- Notes on regressions introduced by fixes
- Attestation letter you can share with customers and auditors
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- NHS DSPT
Frequently asked questions
Can you retest findings from another provider?
Yes. This service is independent of who performed the original test. Give us the findings and their evidence and we will reproduce each one against your updated systems, which is often useful when you want a second, impartial confirmation that fixes hold.
What counts as a partial fix?
A fix that reduces but does not remove the exposure, for example a control added on one path but not a parallel one, or an input validated in one place but not another. We flag these explicitly, because a plain pass or fail would hide the real risk that remains.
Is retesting included in your other engagements?
Yes. Every test we run includes a free retest of fixed findings and an attestation letter. This standalone service is for retesting at a larger scale, validating another provider's findings, or revalidating long after the original engagement closed.
Are your prices quoted with VAT?
Proposals are in GBP and exclude VAT. Because we supply from outside the UK, the reverse charge usually applies to UK business customers, so you account for VAT yourself. Your finance team or accountant can confirm the treatment for your organisation.
Can you deliver a CREST or CHECK report?
We don't claim CREST accreditation or CHECK membership. CHECK covers government, public-sector and CNI systems, and its testers need UK security clearance. If a contract names either, raise it at scoping and you'll get a plain answer on whether we can meet it.