Security Testing
RESCOR first performed a penetration test in 1994. Since then, thousands of tests for hundreds of customers — from small businesses to the world's largest companies. Every test is reported using STORM quantitative risk measurement.
Vulnerability Scanning
RESCOR conducts intelligence gathering (discovery) and automated scanning of the scoped systems. Our security experts use scan results as the basis for comprehensive research and analysis — not as the final deliverable. Many firms simply provide an annotated report of automated scan findings. RESCOR's expert research reduces nuisance findings and false positives while identifying vulnerabilities that automated tools miss.
Penetration Testing
RESCOR performs a vulnerability scan, then uses a combination of automated tools and human expertise to attempt to gain unauthorized access to the scoped systems. Penetration testing significantly reduces false positive findings. Because a penetration test has more permissive rules of engagement, RESCOR often identifies vulnerabilities that are not detected by a vulnerability scan alone.
Application Testing
Application testing provides assurance that your applications — especially web applications and APIs — are secure. RESCOR uses automated tools combined with decades of programming expertise to analyze applications for security flaws including parameter and boundary checking errors, excessive privileges, SQL injection, cross-site scripting (XSS), authentication bypass, insecure deserialization, and other OWASP Top 10 vulnerabilities.
Configuration Analysis
RESCOR analyzes the actual configuration of selected systems and networks as a trusted insider (sometimes referred to as a Network Architecture Review). Configuration analysis identifies problems that are not apparent from external testing, and is the only way to categorically disprove the existence of certain vulnerabilities. This includes cloud configuration review for AWS, Azure, and GCP environments.
Social Engineering
RESCOR uses phone, email, web, and on-site covert research and subversive access attempts (pretexting) to test the strength of your policies, staff training, and technical controls. Social engineering identifies failures in security awareness and information handling practices that may allow an attacker to obtain valuable information from unsuspecting or uninformed employees.
Why RESCOR Testing Is Different
- Expert Research
- Our expert research and analysis identifies 20-50% more critical vulnerabilities than automated tools alone. Automated scanners are the starting point, not the deliverable.
- Quantitative Reporting
- All results are reported using STORM quantitative risk measurement — consistent across all test types, immediately understandable to all audiences from the Board to technical staff.
- Service After the Test
- RESCOR provides post-remediation report updates at no additional charge. When you fix the findings, we update the report to reflect your improved posture.
- Programming Expertise
- Our testing team has decades of software engineering experience across all major platforms and languages. We find vulnerabilities that testers without development backgrounds miss.
- Experience
- More experience than most organizations — including those much larger than RESCOR. Thousands of tests since 1994 across every industry and platform.
Security testing is one component of a comprehensive SGRC program. Learn about RAPID — RESCOR's methodology for building and maintaining complete security programs — and StrongCOR subscription engagements that include scheduled testing along with governance, risk management, and compliance support.
What the Data Shows
Across more than a decade of security testing, two patterns emerge. Internal networks consistently measure higher vulnerability exposure than Internet-facing surfaces, and the annual mean for both horizons trends downward as client programs mature under STORM measurement and RAPID-paced remediation. The charts below draw from the full RESCOR testing database and include every assessment conducted since 2012.
Note on what these charts measure: a security test produces a vulnerability exposure score (RSK/VM), not a risk measurement. Exposure is an indicator of risk, not risk itself — risk requires the asset and threat context that a STORM/RM assessment adds. These charts therefore show exposure trends and distributions, not risk trends. All values are scaled to a 0–100 range for comparability across test scopes.
Annual Mean by Horizon
Figure — Annual mean aggregate vulnerability exposure by horizon, 2012–2025. Each year's mean and interquartile range are computed across every client assessment recorded in that year — typically a dozen or more tests drawn from across the RESCOR client base, not a single client. Missing years connect directly to the next available year.
Measurement Distribution
Figure — Distribution of every scaled vulnerability-exposure measurement in the RESCOR testing database, binned every 10 units. Internet-facing measurements cluster in the lower half of the range; Internal measurements cluster in the upper half — the typical finding across industries.