Quick answer: A penetration test does not end when the report is delivered; the real work is completed by closing the found flaws and verifying it. A retest is an expert checking again whether the flaws the organization says it fixed are actually closed. Why is this needed? Because marking a flaw as fixed does not mean it is actually fixed; the patch may be incomplete, applied in the wrong place, or the fix may have opened another flaw. A good process follows this cycle: test, reporting, remediation, retest and verification. A penetration test without a retest is left half done; because the only real proof that flaws are closed is an expert trying to exploit them again and failing.

Most organizations consider a penetration test finished when the report is delivered. The report is filed away, some fixes are made, and everyone returns to work. But the real question stays unanswered: were those flaws actually closed? Marking a flaw as fixed is easy; proving it is actually closed is another thing. This article explains the most neglected but most critical phase of a penetration test: retest and remediation verification.

Why fixed is not enough

When a flaw is found, the team tries to fix it and usually marks it as closed in a management panel. But this mark is a statement of intent, not a proof. In practice many fixed flaws are actually still open: the patch was applied to the wrong environment, the fix only hid a surface symptom, or a configuration change was later reverted. Sometimes it is worse: the change made to close one flaw creates a new flaw elsewhere. This is why the only proof that a fix actually works is testing it again.

A healthy test cycle

Phase What happens Output
Test Expert finds and exploits flaws Verified findings
Reporting Findings are prioritized Action list
Remediation Team closes the flaws Fixed systems
Retest Expert checks the fixes Closure verification
Verification Closed and remaining flaws become clear Final state report

This cycle turns a penetration test from a one time event into a real improvement process. We covered how to read the report and prioritize findings in the how to read a penetration test report article.

What a retest exactly does

In a retest, the expert takes each flaw found in the first test one by one and tries to exploit it again after the organization's fix. The result falls into one of three categories: the flaw is actually closed (exploit fails), the flaw is still open (the fix did not work), or the flaw is partially closed (still exploitable under certain conditions). This turns the organization's fixed list into a real state. A good retest report clearly shows the final state of each finding.

When and how often

A retest should be done after the fixes are complete, ideally within a few weeks or months of the first test; because as time passes, both the validity of the fixes becomes uncertain and new flaws may appear. For constantly changing environments, a continuous penetration testing (PTaaS) model may be more suitable than a one time retest; here testing and verification run as a continuous cycle. The key is to keep the gap between remediation and verification short.

The compliance and proof dimension

A retest is not only a technical necessity but often a compliance and proof requirement. An audit or a customer wants to see not that flaws were found but that they were closed; a retest report is the independent proof of this closure. Being able to say the flaws were verified as fixed by an independent expert, rather than we fixed the flaws, is a much stronger position in both audits and customer relationships.

The KAOS and DSET approach

DSET does not consider a penetration test finished with report delivery; it treats the remediation and retest phase as an inseparable part of the process. Our local AI engine KAOS documents every flaw found in the first test with a proof and, in the retest phase, tests the same flaw again to verify whether the fix actually worked. The final state of each finding is reported with a working proof. The goal is to close a flaw not by saying it is closed but by proving it is actually closed.

Frequently asked questions

If I fixed the flaws, is a retest necessary? Strongly recommended. A fixed mark is a statement of intent, not a proof. In practice many fixes are applied incompletely, go to the wrong environment, or create a new flaw. The only proof that a fix actually works is an expert trying to exploit the flaw again and failing. Without a retest, you cannot be sure the flaws are closed.

When should a retest be done? After the fixes are complete, ideally within a few weeks or months of the first test. Keeping this gap short matters; as time passes the validity of the fixes becomes uncertain and new flaws may appear. In constantly changing environments, a continuous test and verification model is more suitable than a one time retest.

Do I pay the same as the first test for a retest? Usually no. A retest does not redo the entire scope of the first test; it only verifies whether the found flaws are closed, so it is more focused and generally lower cost. Most security firms offer the retest as part of the first test package. Clarifying this cost upfront should be part of the preparation phase.

Sources

To verify your fixes after a penetration test and complete the cycle, contact DSET. We provide penetration testing, retest and verification from our Ankara Hacettepe Teknokent laboratory.