Frequently Asked Questions

1. What is a penetration test?

A penetration test, or "pen test," is a method to evaluate the effectiveness of an organization's security controls by simulating real-world attack scenarios. It goes beyond basic vulnerability scanning to identify gaps in security controls and determine how an attacker could escalate access to sensitive information. It uses tools and techniques guided by a methodology and results in a report with findings and recommendations to improve security. An ongoing program is recommended for a proactive approach to security

2. Why Qualysec?

Qualysec is a leading penetration testing company that uses a process-based approach and prevention-based techniques. We specialize in testing web and mobile applications, IoT devices, Blockchain, and cloud infrastructure for global enterprises. Our manual testing and automation tools ensure thorough and accurate results. We also offer in-house tools and processes to enhance testing capabilities and provide comprehensive and effective solutions. Our reports include clear and concise steps for reproducing vulnerabilities, accurate mitigation steps, and relevant resources and guidance. We also provide onboarding assistance and daily updates during the assessment and post-assessment consultation for any questions or concerns.

3. How does a penetration test differ from an automated vulnerability scan?

They are different testing methods, but should be used together. A vulnerability scan is an automated, low-cost method for testing common network and server vulnerabilities. However, it is not as accurate in validating the accuracy of vulnerabilities or determining the impact through exploitation, and may report false positives or negatives.

4. What should we expect from the penetration testing process?

  • Penetration testing is a highly structured process. As reputable penetration testing company we keep all stakeholders informed throughout every stage of the process.
  • As a company seeking penetration testing services, you should expect a minimum of the following:
  • Clear communication and coordination throughout the process
  • A disciplined, repeatable methodology
  • A tailored approach to fit the unique environment of the business
  • Defined steps for initiation, planning, testing, and delivering accurate results through collaboration.

5. Is pen testing disruptive to our environment? Will our systems go down? What is the pen testing plan?

Proper planning and coordination are crucial for a successful penetration test, as lack of planning can lead to disruptions. It is important to thoroughly identify potential risks for disruption and adjust the approach accordingly. Planning should be done well before the testing start date to allow enough time for communication with project stakeholders. Communication and monitoring should continue throughout the entire testing schedule.

6. What penetration test documentation or reporting should I expect to receive when the test is complete? How are the findings documented?

  • Upon completion of a penetration test, the hiring company should receive a report or deliverable that includes all findings, recommendations, and supporting evidence. The deliverable should clearly outline the scope and boundaries of the engagement, as well as the dates the testing was performed. The findings should be presented both in their technical format and summarized for non-technical audiences. The report should include:
  • Detailed recommendations for improvements and observed vulnerabilities
  • Discussion of potential business impacts from identified vulnerabilities
  • Specific instructions for remediation, including instructional references where appropriate
  • Supporting evidence and examples
  • A step-by-step and screen-by-screen walkthrough of any exploits to enable the organization to understand and reproduce the scenario
  • Executive and summary reports for non-technical audiences.

7. Should we fix all of the vulnerabilities that are reported?

It's important to evaluate all vulnerabilities using a risk-based model first. Each vulnerability should be evaluated for its business impact and probability of being exploited to assign a risk rating. Companies should have defined risk criteria to determine thresholds for remediation. Vulnerabilities above the threshold should be remediated or compensated to bring them within acceptable risk levels. Vulnerabilities that fall within an acceptable threshold may not require remediation and may simply be monitored over time. In compliance situations, specific vulnerabilities may be viewed as compliance gaps, and those gaps should be remediated or compensated controls should be put in place when remediation is not possible.

8. How frequently should we schedule Application Security Testing?

Conducting Application Security Testing on a regular basis is imperative for identifying and addressing new vulnerabilities and threats, leading to sustained IT and security management

9. What are the typical components tested during security testing?

Application testing is a type of software testing that aims to uncover system vulnerabilities and encompasses security principles such as confidentiality, integrity, authentication, and availability.

10. What is the typical duration of a Vulnerability Assessment and Penetration Testing (VAPT) engagement?

The duration of a Vulnerability Assessment and Penetration Testing (VAPT) engagement varies depending on the scope of the testing and the complexity of the applications being tested. On average, a penetration test can take 1 to 3 weeks to submit the vulnerability report.

11. What are the different types of security testing?

Black Box, Grey Box, and White Box Testing are the most common web app security, mobile app security, and network security tests.

12. What is Automated & Manual Testing?

Manual security testing is performed by a Pentester who uses his skills and experience to find out the vulnerabilities in the application. Automation testing is done by tools using default frameworks

13. Do we get any certificate?

Yes, we do provide certificate after completion of penetration testing.

14. What are the standards adhered to in Application Security Testing?

OWASP top 10 (2021), WASC 40 (applications), and SANS 40 are the most crucial security standards.

OWASP top 10 (2021)             Web app, mobile app, API security

WASC 40 (applications)        Web app

SANS 40                                      Web app, mobile app

15. What happens after testing?

After testing, we provide a comprehensive report with all the findings and test cases. After patching the vulnerabilities, you can opt for a validation test. We perform the retest, and after being assured that there are no loopholes left, we close the engagement releasing a certificate.

16. Will you give assurance for the security of the application?

Yes, but only for a specified period based on the project. As most applications do code modifications regularly, there might be a chance of new vulnerabilities whenever the code gets updated. As vulnerabilities evolve on a day-to-day basis, you need to get your applications tested regularly.