A confirmed critical vulnerability should not wait for the final penetration-test report. The provider must activate the agreed urgent channel, protect evidence and give the buyer enough verified information to make an immediate containment decision.
The response must balance urgency with accuracy. An unverified scanner alert can cause unnecessary disruption, while prolonged exploitation can create avoidable harm. The testing team should perform the minimum safe confirmation needed to establish affected target, preconditions and credible impact.
Use the pre-agreed critical threshold
Rules of engagement should define what triggers immediate escalation, who can make the call and which business factors affect severity. Common signals include unauthenticated compromise, broad sensitive-data exposure, privileged control or high-impact transaction manipulation.
The provider should apply the agreed model and professional judgement, then calibrate with authorised buyer contacts. Severity can evolve as context becomes clearer, but notification should not be delayed when credible critical impact is confirmed.
- Technical exploitability.
- Affected authority and data.
- Reach and required preconditions.
- Business and operational consequence.
Stop amplification and stabilise the test
Pause the exact exploit path after sufficient confirmation and stop adjacent activity if it could worsen impact, corrupt data, trigger fraud or disrupt service. Preserve the session and evidence safely.
If testing itself created an unintended condition, invoke the incident and recovery procedure immediately. The provider should not conceal its contribution or attempt an unapproved cleanup.
- Cease repeated exploitation.
- Respect kill switch and stop authority.
- Preserve timestamps and test identifiers.
- Report unintended effects immediately.
Confirm with the minimum safe proof
Reproduce once where safe, using designated accounts and data, and capture the request, identity, target, response and authoritative effect. Check for configuration or environmental artefacts that could create a false conclusion.
A second qualified tester or reviewer should examine the evidence quickly. Critical confirmation should be rigorous but proportionate; do not extract large datasets or establish persistence merely to make the result dramatic.
- Exact target and release.
- Identity and preconditions.
- Control and prohibited case.
- Safe proof of material impact.
Create a protected initial notification
Notify the critical contacts through the agreed secure channel and mark the message according to the buyer’s sensitivity scheme. Use telephone or another rapid path when required, followed by written evidence.
The initial notice should be concise: what is affected, why impact is critical, what was safely proven, whether testing paused, immediate containment options and when a fuller update will arrive.
- Finding identifier and time.
- Affected system and concise impact.
- Testing state and operational observation.
- Requested acknowledgement and decision.
Obtain acknowledgement and activate ownership
A sent message is not successful escalation. Obtain acknowledgement from the named owner or alternate and record the time, recipient and decision path.
The buyer assigns incident, vulnerability, engineering, operations, legal, privacy or compliance ownership according to context. The provider remains available but does not replace organisational authority.
- Primary and fallback recipients.
- Acknowledgement timestamp.
- Incident or vulnerability owner.
- Next coordination time.
Choose containment based on business risk
Options may include disabling a function, revoking credentials, tightening gateway rules, isolating a service, adding monitoring or applying a controlled configuration change. The buyer weighs security reduction against availability and safety.
Document temporary controls, approval, deployment time and expected side effects. Avoid a hurried patch that destroys evidence or creates a different uncontrolled failure.
- Immediate exposure reduction.
- Service continuity consequence.
- Approval and implementation owner.
- Verification and rollback plan.
Separate incident investigation from pentesting authority
A critical finding may indicate prior exploitation, but the pentest engagement may not authorise log collection, endpoint forensics or third-party investigation. The buyer should activate its incident-response process when warranted.
Preserve test source addresses, accounts, payload markers and timestamps so responders can distinguish authorised activity. The provider shares relevant evidence securely and avoids contaminating forensic sources.
- Test traffic identifiers.
- Potential compromise indicators.
- Evidence chain and access.
- Separate investigative authorisation.
Control whether testing resumes
The buyer and provider decide whether to resume unaffected scope, pause the entire engagement or work in a repaired environment. Record the decision, authority and changed constraints.
Continuing can reveal related weaknesses, but it must not distract from containment or expose the system further. A temporary control may also change test validity and the target baseline.
- Paused and permitted areas.
- New rate or technique restrictions.
- Environment or release change.
- Revised schedule and coverage effect.
Investigate systemic variants safely
After immediate risk is controlled and authority is confirmed, test other operations, roles, tenants or services that share the vulnerable control. The goal is to define root-cause reach, not to multiply exploit evidence.
Variant work may become a scope change if it crosses targets or effort boundaries. Record the sample and remaining uncertainty so one repaired endpoint is not mistaken for systemic closure.
- Shared authorization or identity layer.
- Alternate API and client paths.
- Peer tenants and roles.
- Common libraries or configurations.
Maintain a living finding record
Update the protected finding with confirmed facts, decisions, containment, scope changes and revised severity while retaining the original timeline. Clearly distinguish observed evidence from hypotheses and buyer-provided context.
The routine engagement update should only state that the urgent process was activated and acknowledged unless recipients are authorised for more. Exploit details remain restricted.
- Immutable event chronology.
- Evidence and peer review.
- Decision and containment log.
- Restricted distribution.
Fix root cause and verify the interim state
Engineering should repair the shared cause, add regression tests and review related design or process failures. Temporary filters or disabled functions may reduce exposure but are not automatically permanent remediation.
The buyer validates that containment is active in the intended environment. The provider may verify a narrow control when authorised, but the formal retest should use the corrected baseline and agreed scope.
- Root-cause correction.
- Secure design or configuration change.
- Automated and manual regression.
- Interim-control verification.
Include the issue in final reporting
The final report preserves the critical finding, evidence, severity rationale, urgent escalation and current disposition. It should not erase the original exposure because a fix was deployed during testing.
Coverage and schedule changes caused by the response belong in the limitations and engagement chronology. This lets assurance readers understand both the risk and the organisation’s response.
- Original affected baseline.
- Escalation and containment chronology.
- Remediation status.
- Coverage and residual limitations.
Retest the permanent correction independently
Retest the original proof against the corrected release, verify relevant variants and confirm that temporary controls did not merely hide the symptom. Use the same safe evidence discipline.
Issue a closure record that states fixed, partial, not fixed or cannot verify and names remaining risk. The buyer separately decides risk acceptance, release and external notification obligations.
- Confirm the corrected target and active controls.
- Repeat the minimum safe proof.
- Check representative systemic variants.
- Record independent outcome and residual risk.
Use NIST SP 800-115 for technical-assessment planning and NIST SP 800-61 Revision 2 for incident-response concepts. Align the actual escalation and response with the buyer’s approved rules, incident plan and legal obligations.
Treat critical discovery as a controlled handoff
The decisive moment is not the final severity label. It is the protected transfer from testing evidence to an acknowledged organisational owner who can contain risk without losing traceability.
WIMD uses predefined escalation, minimum-safe proof, operational stop authority and release-specific retesting so urgent action remains both fast and defensible.