Retests, and Your Client’s Jira, ServiceNow or GitHub

A retest is where a test turns into fixed issues, and it is usually run from an email thread and a spreadsheet. In Pental it lives on the finding: the client asks for it there, your team picks it up from one list, and the outcome is recorded on the finding the client is looking at.

Which findings can be retested

When you create an engagement, each phase says whether the client can ask for a retest. A phase that includes one shows the client a Request Retest button on its open findings; a phase without one does not, so nobody asks for work that was never sold.

The client asks

Once something is fixed, the client opens the finding and presses Request Retest, or ticks several and asks for them together. A request is only a request: it changes nothing about the finding until one of your testers acts on it, and the finding shows Awaiting retest in the meantime.

Or their own tracker asks

Clients can connect their own tracker at the foot of their dashboard: Jira, ServiceNow, Azure DevOps, GitHub, GitLab or Linear. A finding then becomes a ticket in one click, with its details and how to fix it, and their engineers work it in their tracker as usual. Closing the ticket asks you for a retest rather than closing the finding: the fix is checked before anything is closed, and once it is, the finding is closed and so is the ticket.

Your team can connect a client’s tracker for them too, from the client’s record, choosing the lowest severity that is raised (Medium and above, to begin with) and whether a ticket is raised automatically as each finding is released. Every tracker is read back each hour, and Sync now does it at once.

Your team retests

Retest Requests, in the sidebar whenever something is waiting, with a count, lists everything clients have asked for. Begin Retest opens the finding with a place for what was found this time, and Remediated or Not Remediated records the outcome. The client sees it on the finding straight away, and a retest summary for the engagement can be drafted from the outcomes, in the report’s Retest Summary section.

For running the retest itself well, see how to run a penetration test retest properly, and for a client who decides not to fix something, when a client accepts the risk instead of fixing it.