methodology

Every engagement — whether a one-time VAPT or an ongoing Shield subscription — follows a consistent, standards-based process. Here's exactly what that looks like, and which frameworks it's built on.

Standards We Align To

OWASP Testing Guide & OWASP Mobile Security Testing Guide (MSTG)

For web applications and APIs, testing is structured around the OWASP Testing Guide's methodology, covering areas like authentication, session management, input validation, business logic, and access control. Mobile app engagements (Android/iOS) follow the equivalent OWASP MSTG structure.

PTES (Penetration Testing Execution Standard)

Network and infrastructure engagements follow the PTES phases: pre-engagement scoping, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting — ensuring nothing is skipped between "found a vulnerability" and "confirmed real-world impact."

NIST SP 800-115

Testing planning and reporting structure draws on NIST's Technical Guide to Information Security Testing and Assessment, which is the reference many enterprise and government-adjacent clients expect assessments to be traceable to.

CVSS v3.1 Severity Scoring

Every finding is scored using the Common Vulnerability Scoring System (CVSS v3.1), giving you a standardized, defensible severity rating (Critical / High / Medium / Low / Informational) rather than a subjective label — this is also what most compliance auditors and enterprise security teams expect to see in a report.

Our Process

1. Scoping Call

A short call to understand your application, infrastructure, and any compliance target (SOC 2, ISO 27001, DPDP Act, Cyber Essentials, etc.) before anything is quoted or scheduled.

2. Reconnaissance & Enumeration

Mapping the attack surface — endpoints, subdomains, exposed services, technology stack — to understand what's actually in scope before testing begins.

3. Automated + Manual Testing

Automated scanning surfaces known vulnerability classes quickly; manual testing is where a real tester attempts to chain issues together and demonstrate genuine business impact, not just a scanner output.

4. Exploitation & Validation

Confirmed findings are validated with proof-of-concept evidence, not left as unverified scanner flags — this is what separates a penetration test from a vulnerability scan.

5. Reporting

A detailed report with CVSS-scored findings, business impact, and clear remediation steps — written to be usable by both your engineering team and, where relevant, your compliance auditor.

6. Remediation Support & Re-Test

Practical guidance for fixing each finding, followed by a free re-test to confirm issues are actually resolved before a completion certificate is issued.

A Note on Our Team

Nexoryn Security's testing work is performed by our in-house testing team, not outsourced or automated-only. If you'd like details on individual tester certifications relevant to your specific engagement, that's something we're happy to cover on the scoping call — reach out here.

Want to see this process applied to your own application or infrastructure? Talk to Nexoryn Security for a free scoping call, or explore Shield for continuous protection — starting at ₹8,000/month.