Practical Validation - Controlled Testing
Retesting
Cocoon verifies whether previously identified vulnerabilities have been effectively resolved and if the implemented improvement measures are sustainable in practice.
- Targeted verification of previously identified vulnerabilities, conducted within pre-defined frameworks
- Comparison with the findings from the original test
- Report with a clear status for each finding: resolved, partially resolved, or still open
What is a Retest?
A retest is a targeted, one-time verification of vulnerabilities that Cocoon previously identified in a specific test, such as a physical penetration test, Red Teaming, or a Mystery Visit. Instead of re-examining the entire security posture, Cocoon verifies whether the findings identified at that time have actually been remedied and if the measures taken are effective in practice.
This service is relevant for organizations that have implemented improvement measures after a previous test and want to know if those measures are truly effective, for example, prior to an audit, after completing an improvement plan, or as substantiation for management or regulators that previous findings have been closed.
How Cocoon Conducts a Physical Penetration Test
With many alternatives, “resolved” is assumed once a measure has been implemented on paper, without retesting whether it actually works. Cocoon, therefore, always retests in practice, with the same rigor as the original test.
A retest also follows our established setup, focusing on the previously identified findings. During preparation, we jointly determine which findings will be verified and which improvement measures have since been implemented, such as tightened access procedures, technical provisions, or additional training. During execution, our auditors attempt to gain access again using the same or similar attack scenarios as in the original test, and they assess whether employees recognize anomalous behavior, apply protocols correctly, and actively report suspicious situations.
Where relevant, we also assess whether physical security measures align with the digital security policy and if both effectively reinforce each other. This not only answers whether a specific vulnerability has been closed but also provides insight into the maturity of the security organization as a whole.
All findings are documented and directly compared with the results of the original test. You will receive a report clearly outlining the improvements made, remaining areas of concern, and any new risks.
Why choose Cocoon
For Cocoon, a retest is the objective culmination of an improvement process: not assuming a measure works, but proving it. We do not assess our own security measures, which makes our findings objective. Where possible, the same team that performed the original test also conducts the retest, ensuring a fair and substantiated comparison.
A one-time test provides a snapshot. A retest shows whether that snapshot endures.
Based on the retest results, we are happy to determine the next step together: addressing remaining findings specifically, or transitioning to a periodic penetration test once the foundation is in order.
- Independent validation, separate from implemented security systems
- Same team and scenarios as the original test, for a fair comparison
- Objective substantiation for management, clients, or regulators
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Performing a retest helps meet the requirements of NIS 2 and ABRO.
Cocoon works for reputable (publicly traded) companies in profit and non-profit environments; references available upon request.
Frequently asked questions
What is the Cost of a Retest?
The cost of a retest is typically lower than that of the original test, as the scope is limited to previously identified findings. Following a brief intake, you will receive a customized quote.
How long after the initial test can a retest occur?
This depends on the speed at which remediation measures are implemented, typically ranging from several weeks to several months after the initial test. Retesting too soon is ineffective if measures have not been fully deployed.
Is a retest legal?
Yes. A retest is performed exclusively with the client’s written consent, within pre-agreed Rules of Engagement. These frameworks are reconfirmed prior to the retest.
What is the difference between a retest and a periodic penetration test?
A retest is a one-time verification of previously identified vulnerabilities from a specific test to confirm that remediation measures are effective. A periodic penetration test is broader: a recurring cycle of comprehensive tests, regardless of previous findings, focused on structural validation rather than the verification of a single prior report.
Does the same team perform the retest as the original test?
Whenever possible, yes. This makes the comparison with the original findings more precise and prevents the loss of knowledge regarding your organization and previous scenarios.
What Happens If Findings Remain Unresolved?
This is reported as such. A retest is not a second attempt, but an objective measurement: you receive an honest overview of what has been resolved, what has been partially resolved, and what still requires attention.
Can a retest be performed following a test by another party?
Yes, provided the original findings and report are available. Cocoon will then verify whether the previously identified vulnerabilities have been resolved, even if the initial test was not conducted by Cocoon.