Penetration Tests

Manage penetration testing programs with provider integration, finding tracking, and automated evidence collection.

Overview

The Penetration Tests module lets you plan, execute, and track penetration testing engagements directly in Matproof. Connect your testing provider, import findings, track remediation, and automatically link results as evidence against the relevant compliance controls.

Penetration testing is required or recommended by most compliance frameworks:

Framework	Requirement
DORA	TLPT (Threat-Led Penetration Testing) every 3 years for significant entities
ISO 27001	A.18.2.3 - Technical compliance review
SOC 2	CC7.1 - System monitoring and penetration testing
PCI DSS	Requirement 11.4 - Annual penetration testing
NIS2	Article 21 - Testing effectiveness of cybersecurity measures

Navigate to Penetration Tests in the sidebar to access the module.

Creating a test engagement

1. Define the scope
3. Execute the test
4. The testing provider conducts the engagement. During the test period, the engagement status shows as In progress in Matproof.
5. Import findings
6. After the test completes:
8. You can also add findings manually if needed.

Finding management

Each finding contains:

Field	Description
Title	Short description of the vulnerability
Severity	Critical, High, Medium, Low, Informational
Description	Detailed description including the attack vector and impact
Affected asset	Which system or application is vulnerable
Status	Open, In remediation, Remediated, Accepted, False positive
Remediation owner	Team member responsible for fixing the issue
Due date	Target date for remediation
Evidence	Proof of remediation (screenshot, configuration change, retest result)

Remediation workflow

1. Review imported findings and assign owners
2. Set remediation due dates based on severity:
   • Critical: 7 days (recommended)
   • High: 30 days
   • Medium: 90 days
   • Low: next scheduled maintenance window
3. Owners update the finding status as they work through fixes
4. Upload remediation evidence (configuration changes, patches applied, retest results)
5. When all findings are addressed, mark the engagement as Completed

Do not mark critical or high severity findings as Accepted without documenting a risk acceptance rationale. Auditors will scrutinize accepted findings, especially for frameworks that require active vulnerability remediation.

Provider integration

Matproof integrates with penetration testing providers to streamline finding import:

• Manual upload - upload the provider’s report in PDF, CSV, or JSON
• API integration - for providers with API access, configure automatic finding sync

To configure a provider:

1. Go to Settings - Integrations - Penetration Testing
2. Select your provider or add a custom one
3. Follow the setup instructions for API-based sync

Linking to compliance controls

Penetration test results serve as evidence for multiple framework controls. To link findings:

1. Open a completed engagement
2. Click Link to controls
3. Matproof suggests relevant controls based on the engagement type and findings
4. Confirm the mapping - the engagement summary and finding status become evidence on those controls

Set up recurring test engagements (quarterly or annually) and link them to the same controls. This creates a continuous evidence trail that demonstrates ongoing testing over time.

Scheduling and reminders

Stay on top of your testing program:

1. Go to Penetration Tests - Schedule
2. Set up recurring reminders (e.g., “External pentest due every 12 months”)
3. Matproof sends notifications 30 days before the next test is due
4. Track compliance with testing schedules from the dashboard

Reporting

Generate penetration test summary reports:

1. Open a completed engagement
2. Click Generate report
3. The report includes: scope, findings by severity, remediation status, and timeline
4. Export as PDF for management review or audit evidence