Network / Infrastructure VAPT

1 Assessment Details

Mandatory

Organization name *

Technical contact for scope clarifications *

Target start date *

Number of locations / sites in scope *

Services required *

Vulnerability Assessment Penetration Testing Retest only

2 Scope Type and Testing Approach

Mandatory

Assessment type *

External infrastructureInternet-facing assets, tested from outside the network Internal infrastructureTested from inside the approved network

Testing approach * Must answer

Grey Box — recommended White Box Black Box Not sure

Grey Box shares limited information plus credentials. White Box adds full device configurations and network diagrams. Black Box shares nothing, so part of the effort goes into discovery rather than testing.

Assessment mode *

Unauthenticated only Authenticated Both

Internal testing location *

How frequently should the assessment be carried out? *

Single-time engagement Quarterly assessment Continuous assessment

Please note: assessment frequency is not included in the timeline estimate in section 10. The estimate covers a single assessment cycle only. Frequency, and the schedule for repeat cycles, is agreed while finalising the scope.

A single-time engagement covers one assessment cycle together with its retests.

Will network diagrams and asset inventory be shared?

Yes Partially No

Will device configurations be shared for review?

A full firewall rule-base audit is only possible when configuration access is provided.

3 Asset Inventory and Counts

Drives effort

Enter approximate counts — leave blank or zero where not applicable. These counts feed the timeline estimate in section 10.

Asset counts *

Perimeter and hosts

Public IP

Internal IP

Windows laptops / endpoints

Linux / Unix endpoints

Printers

NVR

Servers and appliances

Servers

VMs

Application servers

DB servers

Network devices

Firewalls

Routers

Managed switches

IP ranges, hostnames and asset groups in scope *

Only addresses and hosts listed in the approved scope are tested.

Operating systems in scope *

Any end-of-life or unsupported systems in scope, and can they tolerate scanning?

Endpoint testing approach

Virtualization platform

4 Network Services and Access

Blocks kickoff if incomplete

5 Test Environment and Restrictions

Mandatory

Anything not authorized here will not be tested.

6 Data Sensitivity and Standards

Drives severity ratings

Data stored, processed or transmitted by in-scope systems *

Standards and compliance requirements to be referenced

7 Testing Coverage Areas

All included by default

Deselect any area to be excluded from this engagement.

8 Assessment Methodology

Automated and manual testing, adapted to the approved scope, asset types, operating systems, access level and client restrictions.

01

Scope and Authorization Verification

Approved IP addresses and ranges, hostnames, internal and external separation, asset and device inventory, cloud assets, testing location, authenticated or unauthenticated requirements, credentials, testing period, restrictions and written authorization.

02

Asset Discovery

Live IP addresses, hostnames, operating systems, servers, endpoints, virtual machines, network devices, cloud systems and security appliances — strictly within the approved ranges.

03

Port and Service Enumeration

Open ports, running services, versions and accessible management interfaces; whether exposed services are required, hardened, patched and properly restricted.

04

Automated and Authenticated Vulnerability Assessment

Missing patches, unsupported operating systems, known CVEs, weak SSL/TLS, default configurations and insecure protocols. Authenticated scanning is performed where credentials are provided. All findings are manually reviewed.

05

Configuration and Hardening Review

Accounts, privileges, password and lockout policy, audit and logging, host firewall, remote access, installed software, running services, scheduled tasks, file-system permissions and system-hardening controls.

06

Authentication, Authorization and Network Service Testing

Default and weak credentials, account lockout, MFA, excessive user and service-account privileges, share and ACL permissions, insecure protocols, exposed management interfaces and cleartext credential transmission.

07

Segmentation, Privilege Escalation and Controlled Lateral Access

Zone-to-zone access verification, local privilege escalation paths, credential reuse and trust relationships — limited validation against approved systems only, with no persistence or data exfiltration.

08

Validation, Reporting and Retest

Affected host, port, service and software confirmed and reproduced using controlled techniques without destructive payloads. Findings are severity-rated and documented, then retested after remediation.

This is not a red-team engagement

Testing is limited to the approved asset list, defined testing period, agreed techniques and documented restrictions. The team does not move outside the approved asset list, attempt organization-wide compromise, establish persistence, exfiltrate business data, target employees, or perform stealth or evasion testing.

9 Vulnerability Risk Classification

Severity	Description
Critical	May result in complete system compromise, remote code execution, administrative access, widespread infrastructure impact or significant sensitive-data exposure.
High	May result in unauthorized access, privilege escalation, system compromise, significant data exposure or access to additional approved systems.
Medium	May affect infrastructure security under specific conditions, or may require authentication, limited privileges, internal access or user interaction.
Low	Limited direct impact; remediated as part of infrastructure-hardening and security-improvement activities.
Informational	Configuration observation or hardening recommendation without direct exploitability.

After retesting each finding is marked Closed, Open, Partially Fixed, Risk Accepted or Not Retested.

10 Timeline Estimate

Calculated from the SysTools infrastructure effort model. Asset counts from section 3 are carried over automatically; the OS image, hypervisor and WLAN counts are entered by the assessment team.

Endpoints

Unique OS images

Windows endpoint hosts

Linux / Unix endpoint hosts

Printers

NVR

Servers

General servers

Hypervisor hosts

VMs

Application servers

Database servers

Network devices

Firewalls

Routers

Managed switches

WLAN controllers with APs

Retest

Number of retests

One retest is included as standard. Increase this only if additional retest cycles are required.

Estimated duration 0 working days

Testing0

Retest0

Subject to final scope review, access availability and resource confirmation. The final timeline is confirmed after the complete scope has been reviewed and understood.

Save and Export Response

Responses are stored in this browser until exported or cleared.