Skip to main content

Application Penetration Testing FAQ for AIQ

What happens with vulnerabilities your tool finds, how these are stored (length of time etc), who has access to this data?

All the data are stored in the database, the data is stored for how long we need, it can be backed up or cleaned up as needed, or run a scheduler to remove the data periodically.

The Database Admins will have access to these data which again can be changed depending on the requirements.

We do not handle any PII, PHI, or scoped data in our hosted environment. All test data must be generated on fake test accounts. Which is normal procedure anyway. In addition, Test data and scripts are hosted in the client's own GIT repository.

Phone Home Functionality

For an on-premise implementation, does Appvance have any phone home functionality?

For an on-premise implementation, the system has no phone home. It is designed to work within an air-gapped environment (for DOD applications). We would have no access unless you granted it for a specified time.

Source Code Access

My understanding here is also that this is for fully-built software testing, and no source code will be transferred to your company – is this correct?

We never have access to any source code. We only test fully compiled applications.

Low (Medium) vs Medium (Medium)

In the pdf report generated from the App penetration testing, what does "low (medium)" mean or "medium (medium)" mean?

The first statement is the risk level, and the second statement is the confidence level.

    low (medium) = Low risk level and medium confidence level

    medium (medium) = Medium risk level and medium confidence level

    CREST Certification

    Is the App Penetration functionality in AIQ CREST certified?

    AIQ App Penetration tests run ZAP Active scans. However, OWASP ZAP itself is not CREST certified.

    CREST, a global cybersecurity industry body, has an accreditation program called OWASP Verification Standard (OVS). Companies like Across Verticals, Nettitude, Pentest People, Trustwave, and VerSprite have received CREST accreditation for their application security assessment services.

    Key points about ZAP’s active scan in AIQ App Penetration:

      Vulnerability Detection: Active scanning attempts to find specific types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and other common security issues.

      Limitations: While active scanning is valuable, it won’t discover logical vulnerabilities like broken access control. For a comprehensive assessment, manualApplication penetration testing shouldcontent complementmust automatedstay scanning.within approved scope and customer authorization. Use AIQ and Scenario Editor terminology for current workflows, and avoid documenting steps that could be interpreted as bypassing security controls outside an approved test.

      Common

      questions

      For

      • Can moreAIQ informationautomate onsecurity ZAPchecks? seeYes, when the ZAPchecks Homepage.are
        approved,
        repeatable, and safe for the target environment.
      • Can production systems be tested? Only with explicit written authorization, controls, and an agreed test window.
      • Can real credentials or customer data be used? Avoid them; use dedicated test accounts and masked/non-production data.
      • What evidence should be captured? Capture results, logs, screenshots, and timestamps without exposing secrets.

      Escalation checklist

      1. Confirm scope, owner, target, environment, and allowed techniques.
      2. Coordinate with security monitoring teams before execution.
      3. Review findings with approved stakeholders only.
      4. Document risks, remediation, and retest expectations.

      Last updated: JuneOctober 28,6, 20242026

      If you have any feedback on this topic, please contact us at documentation@appvance.ai

      Back to top