01
Scope and authorise
Agree the boundaries, objectives and rules before testing begins.
Find the weakness. Understand the risk. Act with confidence.
Navasom delivers rigorous vulnerability assessment and penetration testing for the systems and applications your business relies on. Expert-led testing, validated findings and clear remediation guidance give your team a sound basis for action.
See our approachThe right test starts with the right scope.
We begin with what you need to protect and the decision you need to make. Together, we agree the assets and environments in scope, the testing objectives, required access, timing and constraints. Written authorisation, rules of engagement and an escalation route are established before testing begins.
Discuss your scopeWhat we clarify together
What needs assessment, and what is excludedThe system’s function, users, data and integrationsAccess and testing environmentOperational constraints and escalation contactsReporting needs and any retest requirement
A disciplined test, from first scope to verified finding.
02
Test using relevant methods
Select current, recognised testing guidance suited to the system and its risks. Application work draws on OWASP guidance.
03
Investigate and validate
Skilled testers examine potential weaknesses, test their relevance and document evidence. Tool output is not passed through unexamined.
04
Prioritise and report
Assess severity alongside exploitability, exposure and your business context. Explain what to address, why and how.
05
Review and verify
Walk through the results. Where retesting is in scope, verify agreed fixes and record the outcome.
Findings your team can use.
Your report sets out the tested scope, an executive summary, validated findings, affected assets, supporting evidence, business and technical context, clear priorities, and actionable remediation guidance. We review the results with your team so the next steps are understood.
- What did we find?
- Where is it and how was it validated?
- What could it mean for this system and business?
- What should be changed first?
- How will the fix be checked?
Sensitive reproduction details are shared through the agreed secure channel.
FindingAccess control gap in a sample workflow
EvidenceReproduced within the agreed test environment
ContextExposure depends on role and data sensitivity
PriorityReview access paths and affected records
ActionApply server-side authorisation checks
VerificationRepeat the agreed test after remediation
Common questions
What do you need to scope a test?
The system or application you want assessed, its purpose, the environment available for testing, access constraints, relevant deadlines and the reason for the assessment. We agree the exact scope and rules with you before work starts. Please do not send credentials or sensitive technical details through the public enquiry form.
Can testing take place around a live environment?
Operational constraints are part of scoping. We agree the environment, permitted actions, test window, exclusions and escalation contacts before testing. If an activity is unsuitable for production, we plan an appropriate alternative.
How are findings prioritised?
We consider technical severity alongside exploitability, exposure and the importance of the affected system to your business. A numeric score is useful context; it does not replace judgment about what to fix first.
Is retesting included?
Retesting is defined in the engagement scope. We agree what will be verified and how the result will be recorded before treating it as part of the work.
Can Navasom help fix what it finds?
We provide remediation guidance with the findings. If you need additional development or security support, we can discuss a separate scope that preserves clear ownership of the fix and its verification.
Let’s define the test that will actually help.
Tell us what needs assessment, why now and any deadline or constraint. We’ll discuss the right scope and next steps.