Buyer guide · VAPT
A scanner export is not a VAPT deliverable.
Use this checklist to compare security-testing proposals and reports on the evidence and decisions they enable.
Minimum engagement outputs
- Written scope, authorisation and rules of engagement.
- Coverage record showing tested, sampled, excluded and unavailable assets.
- Executive summary tied to business impact and material themes.
- Technical findings with reproducible, sanitised evidence.
- Risk rationale that explains exploit conditions and compensating controls.
- Specific remediation guidance appropriate to the system.
- Retest terms and a closure record.
- Secure report transfer and agreed evidence-retention handling.
| Warning sign | Why it matters |
|---|---|
| Only automated severity | Context and business logic are missing. |
| No exclusions or limitations | The report can create false confidence. |
| Screenshots without requests or conditions | Engineering cannot reproduce the issue. |
| Guaranteed “100% secure” outcome | Security testing cannot prove absence of all risk. |
| No retest definition | The customer cannot verify closure consistently. |
Turn the next security decision into a clear scope.
Tell us what you need to protect, prove or improve. We will define the evidence, boundaries and next action before work begins.