Vulnerability assessment identifies potential weaknesses, while penetration testing manually validates exploitability and attack impact within authorised limits.

No. Automated tools are useful, but professional testing includes manual verification, logic testing, attack-path analysis and false-positive review.

Scope may include external or internal networks, web applications, APIs, mobile apps, cloud environments and wireless systems.

It can be performed safely with agreed methods, timing, stop conditions and exclusions, but residual operational risk must be assessed before testing.

It uses approved credentials to inspect patching, configurations and privileges that cannot be assessed accurately from an unauthenticated position.

Priority should consider technical severity, exposure, exploitability, affected data or service, compensating controls and business impact.

It should include scope, methodology, executive findings, technical evidence, risk rationale, remediation guidance and limitations.

Retesting confirms that the specific weakness and related attack path were removed rather than relying only on implementation statements.

Frequency should reflect risk, system change, contractual obligations and threat exposure. Major changes can trigger testing outside the routine cycle.

Qualitcert can help define scope, coordinate testing, present prioritised findings, support remediation tracking and verify closure through retesting.