Nederlands
A successful pentest is an important step towards a more secure application, but does not provide a guarantee of 100% security, and this is true for any pentest provider. Security is not a snapshot but a continuous process. In this answer we outline what a pentest actually delivers, which limitations are inherent to any pentest, and how you keep your application structurally secure.
What a pentest does deliver
After a successful pentest at DongIT, you know with certainty that:
- All vulnerabilities within the tested scope classified as critical, high or medium-high risk have been identified
- Findings have been verified for exploitability and business impact
- You have an auditor-usable report for compliance accountability (NIS2, DORA, DigiD, ISO 27001)
- Your development team has received concrete remediation guidance to address the findings
Why a pentest cannot provide an absolute guarantee
Four factors mean that 100% security through a single pentest is not achievable:
1. A pentest is a snapshot
The findings reflect the state of your application at the moment of testing. Any change afterwards, such as new features, updates, dependencies or configuration adjustments, can introduce new vulnerabilities.
2. The threat landscape changes continuously
New vulnerabilities and attack techniques are published every week. Zero-day vulnerabilities, unknown to the security community at the time of testing, may later be exploited by attackers.
3. Scope limitations
A pentest always has a defined scope. Components outside that scope (such as supporting systems, third-party integrations or legacy components) are not tested. This is a deliberate choice to ensure depth on the core scope, but means risks may remain outside the scope.
4. Human and organizational factors
Technical security of your application is only one layer. Social engineering, phishing, weak passwords, inadequate access control and insider threats remain risks that a pentest of your application cannot fully address.
How to maintain security structurally
A pentest is most effective as part of a continuous security strategy. Concrete recommendations:
Align pentest cadence with your context
- Annually for most organizations (mandatory under DigiD, common under ISO 27001 and NIS2)
- Semi-annually for critical applications, financial services and organizations under DORA
- With every major release for SaaS platforms and applications in continuous development
- Upon architectural changes such as cloud migration, SSO implementation or integration with new partners
Additional security measures
- Patch management. Update software and dependencies structurally to close known vulnerabilities.
- Continuous monitoring. Log analysis, WAF, SIEM and real-time detection.
- Secure development. Code reviews and secure coding standards integrated into the development pipeline.
- Awareness training. Train employees and developers on phishing, social engineering and safe handling of data.
- Incident response plan. Define in advance how you respond to a security incident. Who does what, when and with what authorization.
How DongIT supports you after the pentest
Beyond a regular pentest, DongIT offers several services to keep your application structurally secure:
- Retest after remediation, to verify that vulnerabilities have actually been resolved
- Vulnerability remediation guidance, where our pentesters support your development team in addressing findings
- Source code review, to identify vulnerabilities that only become visible with source code insight
- Pentest cycle programmes, where DongIT executes a structured testing programme annually or per release
Want to know which pentest cadence fits your organization? Contact us for a complimentary scoping conversation, or view our pentest packages.