GUIDE · Vulnerability Assessment & Penetration Testing
Find the Weaknesses Before Attackers Do.
Authorized testing of networks, applications and cloud environments shows which vulnerabilities are truly exploitable.
- Validated, prioritized vulnerabilities
- Independently validated defenses
- Evidence for compliance testing requirements
- 1Define Objectives
- 2Map Attack Surface
- 3Validate and Exploit
- 4Rate and Report
- 5Verify Remediation
Executive Summary
- 01A scan lists possible flaws, while a penetration test proves which ones an attacker can actually use.
- 02The value of a test lies in the attack path, the evidence and the fix, not in the number of findings.
- 03Testing works as a recurring control, because new code, cloud services and accounts keep changing exposure.
The Challenge
Vulnerability scans produce long lists that rarely show which weaknesses an attacker could chain together.
Untested internet-facing services and applications remain a common entry point for intrusions.
The DAAKYI Approach
DAAKYI combines automated discovery with manual testing to validate exploitability within an agreed scope and rules of engagement.
Each finding includes business impact and a practical fix, and retesting confirms closure.
- 01
Scoping and rules of engagement
- 02
Vulnerability discovery
- 03
Manual exploitation testing
- 04
Reporting and retest
In Depth
How the Discipline Works
Scoping Defines What Proof Means
Every test starts with a decision about what the organization needs to learn. A scope names the targets, the permitted techniques, the testing windows and the people who can stop work if something goes wrong. It also states the objective. One engagement may test whether an outsider can reach customer records. Another may check whether a stolen employee credential leads to administrative control. Clear objectives keep testers focused on risk rather than volume. Written authorization protects both sides, because it separates lawful testing from intrusion. Emergency contacts and escalation paths matter most when a tester finds signs of a real, earlier compromise.
Discovery Builds the Attack Surface Map
Discovery combines automated scanning with human reconnaissance. Scanners enumerate hosts, open ports, service versions and known flaws quickly. Testers then look for what tools miss: forgotten subdomains, exposed administration panels, leaked credentials, default configurations and APIs absent from documentation. The output is not a finding list. It is a map of reachable assets and likely paths. Testers review scanner results to remove false positives and to spot weaknesses that matter only in combination, such as a low-severity information leak that reveals a username format. Good discovery also records what was not tested, so coverage gaps are visible to the reader.
Exploitation Proves Impact Safely
Manual exploitation separates theoretical risk from demonstrated risk. A tester attempts to use a weakness, then stops at the agreed boundary. Proof may be a screenshot of a record header, a harmless file written to a test directory or a captured session token, not bulk data extraction. Testers chain findings the way an attacker would: an exposed service yields a foothold, the foothold yields credentials, the credentials open an internal system. Each step is logged with timestamps so defenders can compare activity against their own monitoring. That comparison often reveals detection gaps as clearly as it reveals vulnerabilities.
A vulnerability is only a risk once someone can reach it, use it and gain something from it.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Network Testing | External and internal infrastructure. | GUIDE stage | – | – | Advisory Engagements |
| Application and API Testing | Web, mobile and API attack surfaces. | GUIDE stage | – | – | Advisory Engagements |
| Cloud Configuration Testing | Cloud vulnerability testing. | GUIDE stage | – | – | Advisory Engagements |
| Retesting | Confirmation that fixes work. | GUIDE stage | – | – | Advisory Engagements |
Network Testing
External and internal infrastructure.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Application and API Testing
Web, mobile and API attack surfaces.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Cloud Configuration Testing
Cloud vulnerability testing.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Retesting
Confirmation that fixes work.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
How It Works
How Vulnerability Assessment & Penetration Testing Works
- 01Scope
- 02Discover
- 03Exploit
- 04Retest
Methodology
The Method, Step by Step
- 1
Define Objectives
Agree what the test must prove, which assets are in scope and which are excluded. Record permitted techniques, testing windows, data handling rules and stop conditions. Name technical contacts on both sides. Obtain written authorization from the asset owner, including any third-party hosting or cloud provider whose terms require notice.
- 2
Map Attack Surface
Enumerate domains, addresses, services, applications and cloud resources reachable from the chosen vantage point. Run authenticated and unauthenticated scans where agreed. Correlate results with asset inventories to find unknown systems. Rank targets by exposure and by the value of what they protect, so manual effort goes where compromise would hurt most.
- 3
Validate and Exploit
Confirm each scanner result by hand and discard false positives. Test business logic, authentication, authorization and input handling that tools cannot judge. Attempt exploitation within limits, and chain weaknesses toward a defined objective. Capture evidence of each step so the client can reproduce the issue.
- 4
Rate and Report
Rate each finding by exploitability, reachable impact and the sensitivity of affected data, not by scanner score alone. Describe the attack path in plain language. Pair every issue with a specific fix and an owner suggestion. Give leadership a short summary of overall exposure and the few actions that reduce it most.
- 5
Verify Remediation
After fixes are deployed, repeat the original attack steps against each finding. Mark it closed, partly mitigated or still exploitable. Check that the fix did not introduce a new weakness nearby. Update the report so auditors and management see current status rather than a historical snapshot.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Threat Scenarios
What It Looks Like in Practice
Exposed Administration Interface
How It Shows Up
A management console for a firewall, database or content system answers on the public internet with default or weak credentials.
Response
Testing confirms reachability, runs agreed authentication checks and shows what the console controls, so the owner can restrict access.
Stolen Employee Credentials
How It Shows Up
A phished password works on a VPN or cloud portal that lacks strong multifactor enforcement.
Response
Internal testing starts from a low-privilege account and tests whether it can escalate, move laterally and reach sensitive systems.
Broken Access Control in an API
How It Shows Up
A customer can read another customer's records by changing an identifier in a request.
Response
Testers replay requests across accounts and roles, then document which objects and functions lack server-side authorization checks.
Cloud Storage Misconfiguration
How It Shows Up
A storage bucket or snapshot is readable by anyone, or an overly broad role lets a compromised workload reach other services.
Response
Configuration testing reviews permissions and attempts agreed access paths, then recommends least-privilege fixes.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Exposed Administration Interface | A management console for a firewall, database or content system answers on the public internet with default or weak credentials. | Testing confirms reachability, runs agreed authentication checks and shows what the console controls, so the owner can restrict access. |
| Stolen Employee Credentials | A phished password works on a VPN or cloud portal that lacks strong multifactor enforcement. | Internal testing starts from a low-privilege account and tests whether it can escalate, move laterally and reach sensitive systems. |
| Broken Access Control in an API | A customer can read another customer's records by changing an identifier in a request. | Testers replay requests across accounts and roles, then document which objects and functions lack server-side authorization checks. |
| Cloud Storage Misconfiguration | A storage bucket or snapshot is readable by anyone, or an overly broad role lets a compromised workload reach other services. | Configuration testing reviews permissions and attempts agreed access paths, then recommends least-privilege fixes. |
Outcomes
What Your Institution Gains
- Validated, prioritized vulnerabilities
- Independently validated defenses
- Evidence for compliance testing requirements
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Executive Summary | Gives leadership a plain view of overall exposure and the actions that matter most. |
| Technical Findings Report | Documents each validated weakness with evidence, attack path and rating. |
| Remediation Guidance | Tells engineers the specific change needed to close each finding. |
| Evidence Package | Preserves logs, screenshots and request traces so issues can be reproduced. |
| Retest Statement | Records the verified status of every finding after fixes are applied. |
| Role | Responsibility |
|---|---|
| Executive Sponsor (Client) | Approves scope and risk appetite and removes obstacles to remediation. |
| System Owner (Client) | Confirms asset ownership, provides access and fixes the findings assigned to the team. |
| Lead Tester (Provider) | Plans the engagement, directs technique selection and signs off every validated finding. |
| Engagement Manager (Provider) | Manages schedule, communication and immediate escalation of critical issues found during testing. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc Scanning
Scans run occasionally with no validation, and results sit in long lists without owners.
Stage 2
Scheduled Testing
Periodic tests exist mainly to satisfy audits, and fixes are tracked informally.
Stage 3
Risk‑Driven Testing
Scope follows business-critical assets and threat scenarios, and findings enter a managed remediation process with retesting.
Stage 4
Continuous Validation
Automated scanning runs continuously and manual testing follows major changes. Results feed detection tuning and architecture decisions.
Frameworks and Regulation
The Standards That Shape This Work
PCI DSS v4.0.1
It requires regular vulnerability scanning and penetration testing of the cardholder data environment. The future-dated requirements introduced in v4.0 became mandatory on 31 March 2025.
ISO/IEC 27001:2022
Annex A technological controls cover technical vulnerability management and security testing. Test reports and retest results serve as audit evidence for them.
OWASP Top 10 and ASVS
They give testers shared risk categories and verification requirements for web applications and APIs, which makes coverage easier to explain and compare.
Ghana Cybersecurity Act, 2020 (Act 1038)
It provides for licensing and accreditation of cybersecurity service providers and professionals, which bears on how organizations in Ghana select a testing provider.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for testers who explain their methodology and show sample reports with attack paths, not only scanner exports.
- Confirm that the provider manually validates every reported finding before it reaches your team.
- Check that the rules of engagement cover production safety, data handling and stop conditions.
- Where the Cybersecurity Act, 2020 (Act 1038) applies, confirm the provider meets licensing and accreditation expectations for cybersecurity service providers.
Questions to ask a provider
- How do you validate findings and remove false positives?
- Who performs the manual testing, and how is their work reviewed?
- How do you protect production availability and our data during testing?
- What does retesting include, and how is closure evidenced?
Regulatory & Industry Context
The Obligations This Service Supports
Testing supports requirements in PCI DSS, ISO/IEC 27001 and SOC 2, and regulator expectations for periodic security testing.
Frameworks DAAKYI helps clients implement
- PCI DSS
- ISO/IEC 27001
- SOC 2
- CIS Controls
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- PCI DSS
- ISO/IEC 27001
- SOC 2
- CIS Controls
Testing supports requirements in PCI DSS, ISO/IEC 27001 and SOC 2, and regulator expectations for periodic security testing.
Architecture reference
How Vulnerability Assessment & Penetration Testing Works: Scope → Discover → Exploit → Retest.
DAAKYI combines automated discovery with manual testing to validate exploitability within an agreed scope and rules of engagement.
Attack Chaining and Severity Ratings
Severity scores describe a flaw in isolation. Attackers do not work in isolation. A server-side request forgery issue rated medium may reach a cloud metadata service, return temporary credentials and grant storage access. A verbose error message rated low may disclose a framework version that has a known remote code execution flaw. Testers therefore record preconditions, reachable network position and privilege gained at each hop. They map behaviors to MITRE ATT&CK tactics where useful, so defenders can match test activity to detections. The final rating reflects the whole path. Remediation guidance then identifies the cheapest link to break, which is often a configuration change rather than a patch.
Application and API Test Coverage
Application testing follows the OWASP Top 10 and, for deeper work, the OWASP ASVS. Testers check broken access control by replaying requests with another user's token, altering object identifiers and calling administrative endpoints as a standard user. They test session handling, input validation, file upload and server-side injection. For APIs, they compare the published specification with actual behavior, hunting undocumented endpoints, excessive data in responses and missing rate limits. Mobile testing adds local storage, certificate validation and tamper resistance. Authenticated testing needs accounts at several privilege levels, because most serious flaws sit behind the login page.
Glossary
Key Terms
- Rules of Engagement
- The written limits on targets, techniques, timing and communication that govern a test.
- Attack Path
- The sequence of weaknesses an attacker links together to move from initial access to a target.
- False Positive
- A scanner result that reports a vulnerability that does not actually exist.
- Lateral Movement
- Using access gained on one system to reach other systems inside a network.
Related
Explore Connected Capabilities
Solutions
Platforms
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Vulnerability Assessment & Penetration Testing
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Vulnerability Assessment & Penetration Testing with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Vulnerability Assessment & Penetration Testing will respond.
Request a Security Assessment