// GLOSSARY

Revalidation (Re-test)

A controlled second validation that makes the closure of a fix measurable; the proven form of a 'fixed' claim and the second leg of the fix-verify cycle. The most common and most dangerous assumption in security work is believing a vulnerability has been closed once it is reported; yet a patch can fail in several ways, most of which are invisible to the naked eye. The patch may have been applied in the wrong place, masked only the symptom while leaving the root cause, been effective in one configuration but forgotten in another, or opened a new vulnerability while closing the old one. Revalidation closes this uncertainty: the same vulnerability is tested again with the original exploitation method, and closure is tied to a measurement rather than a word. It is the central step of the monthly rhythm in Continuous Penetration Testing and defines the 'verified as closed' threshold of the mean time to remediate (MTTR); it is also used in the Application Security Penetration Test to measure closure at the end of the project. Its function, in short, is this: sometimes a patch truly closes the flaw, sometimes it leaves its place to another; only a re-test shows which. It is the practical mechanism of verifiable closure.