Pen Test Remediation: What to Fix and in What Order
Pen test remediation is the work of fixing what a penetration test found, in priority order, and then proving the fixes hold. Treat critical findings as a 24 to 72 hour job, high findings as 2 to 4 weeks, and medium findings as the next quarter. Fix by real exploitability rather than by the number of items on the page, then book a retest so you have written evidence the issues are closed.
That sounds simple. In practice, most Australian businesses receive a report with forty findings, feel the weight of it, and either try to fix everything at once or quietly do nothing. Both outcomes waste the test. What follows is the ordering method, the timeframes that are realistic for a small team, and what happens at the retest.
What is pen test remediation?
Pen test remediation is the structured process of triaging, fixing and verifying the vulnerabilities identified in a penetration test report. It has four distinct stages: confirming each finding is real and applies to your environment, assigning an owner and a deadline, applying the fix, and having the tester verify the fix at a retest.
Remediation is not the same as patching. A penetration test frequently finds logic flaws, broken access control and configuration weaknesses that no patch addresses. Those require a code change, a configuration change or a process change. Remediation is also not the same as vulnerability management, which is the continuous scanning and patching cycle that runs all year. A penetration test is a point-in-time deep assessment, and its findings feed into vulnerability management rather than replacing it.
If you have not yet received your report, or you are unsure how to interpret the ratings in it, start with our guide on how to read a penetration testing report.
Which findings should you fix first?
Fix penetration test findings in order of real-world exploitability, not in the order they appear in the report. A finding that lets an unauthenticated attacker reach customer data outranks a dozen missing security headers, even though the headers are faster to close.
Three questions settle the order for almost every finding:
- Can an attacker reach it without credentials? Anything internet facing and unauthenticated goes to the top of the list, because an attacker needs nothing from you to begin.
- What does it give them? Access to customer data, administrative control or code execution is a different category of problem from a version number disclosure.
- Is it part of a chain? A medium finding that hands an attacker the credentials for a second medium finding is effectively a high finding. Good reports flag these chains.
Severity ratings in a report are a guide, not a verdict. Most testers use the Common Vulnerability Scoring System maintained by FIRST, which scores technical severity but knows nothing about your business. A critical rating on a system holding no real data may matter less than a medium rating on the database holding every customer record. You are allowed to adjust the order, as long as you write down why.
How long should penetration test remediation take?
For an Australian small or medium business, a realistic penetration test remediation timeline is 24 to 72 hours for critical findings, 2 to 4 weeks for high findings, 1 to 3 months for medium findings, and the next release cycle for low findings. Informational observations go to the backlog or are formally accepted.
Those windows assume you start within days of receiving the report. The single biggest cause of slow remediation is not technical difficulty, it is that nobody owns the report. Assign a named owner for every finding at a triage meeting within five to ten business days of delivery, with a date against each one, and the work moves.
Two things legitimately stretch a timeline. The first is a finding in third party software where you are waiting on the vendor, in which case you document the compensating control you put in place while you wait. The second is a finding that requires an architectural change rather than a fix, which belongs on the roadmap with an interim mitigation, not in the two week bucket.
What does a penetration test retest actually cover?
A penetration test retest re-examines only the findings from the original report to confirm each one is closed. The tester attempts the same attack again, records the finding as remediated, partially remediated or still open, and issues an updated report. A retest is not a fresh penetration test and will not find new issues introduced since the original engagement.
Most Australian providers include a retest within a defined window, commonly 90 days from the original report. Confirm this before you sign, because a retest purchased separately after the window closes is usually priced as new work. If remediation is going to run past the window, say so early and ask for the window to be extended rather than letting it lapse.
Partial remediation is common and worth understanding. If you fixed the specific endpoint the tester exploited but the same flaw exists elsewhere in the application, a good tester will record the finding as partially remediated. That is a useful result, not a failure, and it is exactly the kind of thing scanners miss. The difference between the two approaches is covered in our comparison of penetration testing and vulnerability scanning.
What should a pen test remediation plan include?
A pen test remediation plan is a single tracked document listing every finding with an owner, a severity, a target date, the fix applied and the verification status. It does not need to be elaborate. A shared spreadsheet or a set of tickets in your existing tracker will satisfy an auditor, a customer and your own team.
| Column | What goes in it | Why it matters |
|---|---|---|
| Finding reference | The identifier from the tester’s report | Links your tracker to the report an auditor reads |
| Severity | As rated, plus your adjusted priority | Shows you thought about business context |
| Owner | A named person, not a team | Unowned findings are the ones still open next year |
| Target date | A real date driven by severity | Turns intent into a commitment |
| Fix applied | What actually changed | Lets the tester verify the right thing at retest |
| Status | Open, fixed, risk accepted, or vendor dependent | Makes the remaining exposure visible at a glance |
Risk acceptance deserves a line of its own. You are allowed to accept a finding rather than fix it, provided the acceptance is recorded, has a reason, names who accepted it and carries a review date. An auditor will accept a documented decision. What fails an audit is a finding that is simply unaddressed with no explanation.
Is penetration testing part of vulnerability management?
Penetration testing sits inside a broader vulnerability management programme, but it does not replace it. Vulnerability management is the continuous cycle of scanning, prioritising and patching that runs every week. A penetration test is a periodic, human-led assessment that finds the issues scanning cannot see, such as broken business logic and chained weaknesses.
The practical relationship is that penetration test findings should flow into the same backlog, the same tracker and the same reporting that your scanning results already use. Keeping them in a separate spreadsheet is how findings get forgotten. If your scanning programme is immature, fixing that often returns more value than a second penetration test, because it stops the same low-hanging issues reappearing in every report.
How often you should repeat the test depends on your rate of change and your obligations. Our guide to penetration testing frequency in Australia sets out the common triggers.
How does remediation affect ISO 27001 and SOC 2?
For ISO 27001 and SOC 2, the remediation record matters as much as the test itself. Auditors rarely ask whether you had a penetration test. They ask what you found, what you did about it, how long it took, and what you decided to accept. An untouched report is worse than no report, because it evidences a known risk you ignored.
Under ISO 27001, penetration test findings feed your corrective action process and your risk treatment plan, and unresolved findings surface at the management review. Under SOC 2, unremediated issues can affect the operating effectiveness conclusion in a Type 2 examination. Specific expectations are covered in our guides to what ISO 27001 auditors expect from a penetration test and whether penetration testing is required for SOC 2.
Common questions
What is pen test remediation?
Pen test remediation is the process of triaging, fixing and verifying the vulnerabilities found during a penetration test. It covers confirming each finding is genuine, assigning an owner and deadline, applying the technical or process fix, and having the tester re-examine the issue at a retest to confirm it is closed. The output is an updated report you can show customers and auditors.
Which phase of penetration testing allows for remediation to be performed?
Remediation happens in the post-engagement phase, after reporting and before the retest. The testing phases themselves, which are reconnaissance, scanning, exploitation and reporting, do not include fixing anything. The tester identifies and documents; your team remediates. The retest then closes the loop by verifying each fix against the original finding.
What is a realistic penetration test remediation timeline?
For most Australian SMBs, critical findings should be addressed within 24 to 72 hours, high findings within 2 to 4 weeks, and medium findings within 1 to 3 months. Low and informational items can go to the next release cycle or be formally accepted. Contractual deadlines or a compliance audit date may compress these windows considerably.
Is penetration testing part of vulnerability management?
Penetration testing is one component of vulnerability management, not a substitute for it. Vulnerability management is a continuous programme of scanning and patching. Penetration testing is a periodic human-led assessment that finds logic flaws and chained weaknesses automated scanning cannot detect. Findings from both should feed into the same remediation tracker and reporting.
Do you need a pen test remediation plan template?
A template helps, but the format matters far less than the discipline. Any tracker that records the finding reference, severity, named owner, target date, fix applied and current status will satisfy an auditor and keep the work visible. A shared spreadsheet or tickets in your existing issue tracker both work. What fails is findings with no owner and no date.
Getting remediation done
The value of a penetration test is created after the report, not during it. If you have a report sitting unaddressed, or you want a test that comes with clear remediation guidance and a retest built in, our penetration testing services are delivered by CREST-accredited testers and include practical, prioritised advice rather than a list of raw scanner output. Get in touch to talk through where you are.