Is retesting included in a penetration test?
Retesting may be included, but the usable answer is the window and conditions in your engagement. Ask for the actual dates, eligible findings, request process and updated deliverable. “Unlimited” requests and an unlimited time window are different promises.
What does HackerOne document?
HackerOne describes a remediation period typically lasting 30 or 90 calendar days depending on pentest type, with unlimited vulnerability retests at no extra charge during that period. Its guide allows individual or grouped unresolved findings to be submitted. Confirm the applicable period for your engagement.
What needs clarification with Cobalt?
Cobalt’s pricing table presents six- and twelve-month retesting periods, while its FAQ refers to unlimited on-demand retesting throughout the contract term. Ask which provision governs the package you are buying; we have not resolved that offer-specific question.
Put retesting into the release schedule
The following is a fictional planning example. None of its dates is a provider turnaround promise.
On a small screen, scroll the table sideways to see every column.
| Stage | Example timing | What to record |
|---|---|---|
| Findings received | Day 0 | Finding IDs and agreed retest deadline |
| Correction available | Day 12 | Environment and released version |
| Retest requested | Day 15 | Request reference and eligible finding IDs |
| Result received | Date agreed with provider | Updated status and evidence |
| Customer receives update | After result review | Correct report or attestation version |
What if a fix is ready after the window?
Ask about an extension or additional work before assuming the original fee applies. Also separate a retest of an original finding from assessment of a new feature or substantially changed scope. Obtain the applicable terms in writing.
An engineering ticket marked complete is your team’s record of a change. Agree separately how the provider will represent a finding that is fixed, still reproducible or unable to be checked.
The five lines to add to a quote request
A longer window is useful only if your team can use it and get the output it needs. Compare this work alongside the original testing scope.
- Start and end dates of the included period.
- Eligible assets and original findings.
- Any request limits or additional charges.
- How changed scope is handled.
- The updated report or confirmation supplied after validation.