Index
What is VAPT?
Vulnerability Assessment & Penetration Test (VAPT) is a systematic CVE-based evaluation performed periodically to ensure your network remains resilient, reliable, and highly available. This recurring audit identifies security gaps and confirms your infrastructure’s health against evolving threats.VAPT cycle:
Vulnerability Assessment (VA): The “Scanning” phase. This is the process of identifying, ranking,and reporting known security gaps in an environment. It tells the client what is broken.Penetration
Penetration Testing (PT): The “Attack” phase. This is a simulated, authorized attack where the attempt to exploit those gaps to gain access. It tells the how much damage can be done.
What is a CVE?
CVE (Common Vulnerabilities and Exposures) is a standardized list of publicly disclosed cybersecurity vulnerabilities.
Each CVE has a unique ID, a description, and at least one public reference. It is a universal language used by security tools to communicate.
VAPT Lifecycle: The 6-Stage Security Framework
1. Preparation and Planning (Scoping)
Download gfxtm’s Assessment Spreadsheet
Assessment Guide explains how to enter data, how the sheets are structured, and how results are interpreted.
Asset Inventory: Catalog hardware, software, and cloud assets.
Define Scope & Rules of Engagement (ROE): Define what is “Off-Limits” (e.g., legacy medical equipment that might crash during a scan) and the testing window.
Threat Modeling: Identify likely attackers and their entry points.
2. Discovery and Reconnaissance
Automated Vulnerability Scanning: Execute authorized authenticated and unauthenticated scans to identify known vulnerabilities, CVEs, and missing security patches.
AI-Assisted Analysis: Use AI to correlate scanner findings, software versions, configuration evidence, and known vulnerability information.
Information Gathering: Review relevant publicly available organizational information within the agreed assessment scope.
3. AI Analysis & Expert Validation
AI-Assisted Triage: Analyze scan results, identify duplicate findings, classify potential false positives, and prioritize findings based on available evidence.
Expert Verification: A security professional reviews the findings, validates supporting evidence, and confirms their relevance to the target environment.
Risk Assessment: Evaluate the potential impact and exploitability of confirmed vulnerabilities within the organization’s infrastructure.
Controlled Security Validation: Where explicitly authorized, perform appropriate non-destructive validation to establish whether selected vulnerabilities represent a genuine security weakness.
AI-generated findings are treated as recommendations for investigation, not confirmed vulnerabilities. Final classification and reporting decisions remain subject to expert review.
4. Post-Exploitation & Impact Assessment
Evidence Collection: Document verified findings using appropriate technical evidence while avoiding unnecessary access to sensitive information.
Risk Contextualization: Use the CVSS score but adjust it for the organization’s actual business context. For example, a Medium vulnerability on a core dialysis infrastructure component may present a greater operational risk than a Critical vulnerability on an isolated guest Wi-Fi network.
Business Impact Assessment: Explain potential consequences for service availability, data confidentiality, system integrity, and operational continuity.
5. Remediation and Mitigation
Priority Patching: Apply fixes for the most “Exploitable” paths found in Analysis Phase.
Compensating Controls: Use Web Application Firewall (WAF) rules or VLAN isolation for systems that cannot be patched.
Validation Testing: Re-run the exploit to prove the hole is actually closed.
6. Reporting and Continuous Security
Executive Summary: A high-level view for management.
Technical Breakdown: Detailed evidence for the IT team.
Continuous Monitoring: Approach where security is integrated into the daily IT System/ Network operations.
VAPT Service Engagement & Pricing Framework
gfxtm provides security assessments designed to help organizations understand their exposure, validate security controls, and prioritize remediation. Each engagement is scoped according to infrastructure size, complexity, and operational requirements.
| Service Tier | Focus & Methodology | Primary Deliverables | Pricing |
|---|---|---|---|
| Foundation (VA) | AI-assisted vulnerability analysis, automated scanning, and expert verification. | Verified Vulnerability Report & Remediation Roadmap. | Fixed-Scope Quotation |
| Comprehensive (VAPT) | AI-assisted identification and correlation, expert-led security validation, and authorized exploitation testing. | Technical Assessment, PoC & Attack-Path Analysis. | Asset-Based Quotation |
| Strategic (Expert) | Hybrid-Cloud Security, AI Governance, Infrastructure Risk & Architecture Audit. | Executive Risk Assessment & Security Improvement Strategy. | Custom Engagement |
Engagement Scoping Variables
To provide an accurate estimate, final engagement fees are based on the following:
Infrastructure Density: Total count of unique IP addresses, subdomains, and live endpoints.
Architectural Complexity: Presence of containerized environments or specialized legacy hardware.
Operational Risk: Requirements for testing within specific maintenance windows or on live production systems.
Compliance Frameworks: Reporting tailored for specific regulatory standards (e.g., HIPAA, PIPEDA, PCI-DSS). To perform an immediate self-assessment of your infrastructure, please use our PHIPA-PIPEDA Readiness Checklist. .
Pricing is based on an agreed scope. Remediation, additional testing rounds, and formal compliance certification are quoted separately.
Expert Analysis
VAPT (Vulnerability & Penetration Testing)
Expert analysis of the “Attack Surface” using a multi-round probing methodology.
Port Scanner & Patch Audit
- Process: A minimum of 2 rounds of testing or more.
- Logic: We identify open logical ports and cross-reference OS versions against known vendor security advisories (CVEs).
- Purpose: To close unnecessary entry points and ensure critical security patches are active.
CVSS Score (Severity Rating)
The Common Vulnerability Scoring System (CVSS) is the global industry standard for assessing risk.
- None (0.0): No security impact.
- Low (0.1 – 3.9): Minor risk; usually requires local physical access.
- Medium (4.0 – 6.9): Significant risk; patching required in the next maintenance cycle.
- High (7.0 – 8.9): Serious threat; exploit is likely possible with remote tools.
- Critical (9.0 – 10.0): Immediate threat; high probability of remote compromise or data loss.
AI-Assisted Analysis & Expert Verification
gfxtm combines automated security assessment tools with AI-assisted analysis and professional expertise.
Rather than relying solely on raw scanner output, our methodology uses AI to help correlate vulnerability information, identify duplicate findings, assess potential false positives, and prioritize security risks.
How We Apply AI
- Finding Correlation: Connect scan results with known CVEs, software versions, and available configuration evidence.
- Intelligent Classification: Help distinguish potential security weaknesses from findings that require further investigation.
- Risk Prioritization: Evaluate findings using technical severity and available infrastructure context.
- Report Assistance: Organize technical findings and support the preparation of remediation recommendations.
Expert Verification
AI assists the assessment process, but it does not replace professional judgment.
A security expert reviews the supporting evidence, validates important findings, evaluates their business impact, and approves the final assessment report.
This hybrid approach aims to reduce repetitive analysis while maintaining the reliability and accountability of professional security assessments.
IAM (Identity & Access Management)
Auditing who can enter your systems and what they are permitted to do once inside.
Principal Identity & Auth Method
- Identity: The unique username, email, or service account name.
- Method: The mechanism used for entry: Password-only, Token, 2FA, or Biometrics (FaceID/Fingerprint).
MFA Bypass & Access Abuse
- MFA Bypass: A technical attempt to force or trick the system into skipping the Second Factor (2FA/MFA) during login.
- Brute Force: Testing the system’s “Counter-Measures” (e.g., account lockouts) after multiple failed login attempts.
Privilege Escalation (Low-to-High)
- Audit Logic: We test if a standard user (“Low Level Admin”) can increase their own permissions to “Upper Admin” via system flaws or misconfigurations.
Random Access (Service‑Dependent Memory Access Test)
- Definition: Attempts to access memory or protected system areas through exposed services or misconfigured daemons.
- Audit Logic: This test is only applicable when the system exposes interfaces that allow indirect memory interaction.
- Purpose: To identify unintended access paths that bypass normal authentication flows.
Resources & Tools
Open-Source Intelligence (OSINT) tools
OSINT is the systematic collection of publicly available data to identify security gaps from an “outside-in” perspective.
Link Analysis & Data Visualization. (Used to map complex relationships between people, domains, and infrastructure to find hidden attack surfaces.)
Search Engine for Internet-Connected Devices. (Identifies exposed servers, IoT devices, and medical hardware that may be inadvertently accessible from the public internet.)
Email & Subdomain Gathering. (Scans public sources to find leaked employee credentials and forgotten subdomains that pose a risk to the primary network.)
sherlock-linux Full custom linux tools
Footprint Analysis. (Locates social media and web profiles associated with specific usernames to assess the digital footprint and impersonation risks.)
Understand OSINT
Finding niche resources for specific data types like IP addresses, Metadata, or Public Records. (It represents the logic of an investigation’s starting from a known point and expanding outward.)
Seeing how much of an employee’s professional identity is exposed across non-work platforms.
Architecture & Enterprise Modeling
Archi | |
For creating “Blueprints” of the entire IT landscape. It visualizes the relationship between business processes, software applications, and technical hardware.
Essential for PHIPA/PIPEDA Impact Analysis. It shows exactly which business roles have access to which data servers, making it easy to spot compliance gaps in a diagram rather than a spreadsheet.
Common Vulnerability Scoring System (CVSS)
Common Vulnerability Scoring System Version 4.0 Calculator
CVSS 4.0 is the most advanced version by first.org, that addresses long-standing flaws in 3.1 by adding “Supplemental Metrics” (like Automatable, Recovery, and Value Density) and refining the “Base” score to be more granular.
Common Vulnerability Scoring System Version 3.1 Calculator
This is the largest implementation of the standard and currently by NIST, almost every existing CVE (Common Vulnerabilities and Exposures) is scored using CVSS 3.1. Most scanners (Nessus, OpenVAS) and automated tools still report in 3.1.
Common Vulnerabilities and Exposures (CVE).
CVE.org The official international registry of Common Vulnerabilities and Exposures (CVEs).
CVE Details for historical trend analysis and mapping the security track record of specific vendors and products.
CISA KEV Catalog A prioritized list of vulnerabilities known to be actively exploited in the wild, ensuring that critical risks are patched first.
Analysis & Exploitation
Metasploit contains a massive database of “Exploits” (code that takes advantage of a bug) and “Payloads” (what happens once you get in, like opening a command shell).
Burpsuite is custom linux tools that captures every request and response, allowing you to modify data (like changing a user ID or a price) before it reaches the server.
Note: Understand our methodology & assessment terms and tools.