Aesparrow’s VAPT methodology is a seven-step, manual-first process aligned to the OWASP Web Security Testing Guide, OWASP MASVS, the Penetration Testing Execution Standard (PTES) and NIST SP 800-115. Every finding is verified by a human tester, scored with CVSS and mapped to MITRE ATT&CK and your compliance frameworks.
The seven phases of an Aesparrow engagement
- 1. Scoping and rules of engagement
We agree targets, objectives, test type (black, grey or white box), schedules, contacts, data handling and written authorisation before any testing.
- 2. Reconnaissance and threat modelling
We map the attack surface — hosts, applications, APIs, roles, integrations and data flows — and identify the most likely attack paths.
- 3. Vulnerability assessment
Tuned automated scanning is combined with manual analysis to identify candidate weaknesses across configuration, code and design.
- 4. Manual exploitation
Certified testers safely exploit confirmed issues to prove impact and eliminate false positives, following agreed safety controls.
- 5. Post-exploitation
We assess privilege escalation, lateral movement and data access to show the realistic blast radius of each weakness.
- 6. Reporting and debrief
You receive an executive summary and detailed findings with evidence, CVSS v3.1/v4.0 scores, CWE references and remediation guidance, plus a walkthrough call.
- 7. Remediation re-test
After you fix the issues we re-test them and issue an updated report and attestation letter.
Standards we follow
- OWASP Top 10, OWASP ASVS and the Web Security Testing Guide for web applications
- OWASP API Security Top 10 for REST, GraphQL and SOAP APIs
- OWASP MASVS and the Mobile Top 10 for Android and iOS apps
- PTES and NIST SP 800-115 for engagement structure and technical testing
- CIS Benchmarks for cloud and infrastructure configuration review
- MITRE ATT&CK for red team and adversary emulation
- CVSS, CWE and CVE for consistent scoring and classification
Safety, confidentiality and data handling
Testing only starts after written authorisation. We avoid destructive techniques, schedule higher-risk activity in agreed windows, notify you immediately of critical findings, store evidence encrypted and delete it after the agreed retention period. All testers work under NDA.
Learn more
Read our guides to the VAPT process, what a VAPT report includes and how to choose a VAPT company, or explore our penetration testing services.