VAPT services and assessment scope
Define the systems, access roles and business concerns before commissioning testing. Invitty can scope an assessment and agree the methods, reporting and retesting requirements in a written proposal.
- Web applications and APIs: review authentication, authorisation, input handling, session behaviour and relevant business workflows.
- Mobile applications: specify supported platforms, application builds, backend APIs and access requirements.
- Internal and external infrastructure: identify approved address ranges, services, credentials and testing windows.
- Cloud environments: agree the accounts, services and configuration review boundaries, including any provider permissions.
What the report should contain
Agree an executive summary, tested scope, methods, limitations, prioritised findings, reproducible evidence and remediation guidance. A retest report should identify which findings were retested, their status and any remaining limitations. A report or closure statement is not a guarantee of security, regulatory compliance or acceptance by every customer or auditor.
Confirm delivery requirements before ordering
If your customer or auditor requires particular credentials, accreditation, an empanelled provider or a specific format, state that at the start. Confirm the actual delivery team and required evidence in the proposal. Retest rounds, dates and fees must be explicit.