A VAPT report that stands up to review.

• An independent tester: someone outside your team.
• A clear scope and dates: which systems, which environment, and when they were tested.
• The method: how the test was done, not just scanner output.
• Findings with evidence: each issue rated by severity, with proof and the fix.
• What you did about it: fixes made and, ideally, a re-test showing the serious issues are closed.

Our report covers every point: an executive summary, the methodology, every finding with its severity, evidence and fix steps, and a remediation roadmap.

• Does the requirement name an approved list? If the tender or regulator says the tester must be empanelled or accredited, only those testers count.
• Does it name a standard? PCI DSS, for example, has its own rules on who can assess you. Bug Circuit is not a PCI DSS QSA.
• What exactly is in scope? A fintech may only need the endpoints that talk to a bank. See API penetration testing.

Of 126 registered domains we checked, 34 (27%) had no DMARC record, which makes email forged in their name much easier. This comes from our own free passive checks, last updated 8 November 2026. It is a small sample, not a survey of the whole web. See the full numbers and method.

For how security tests should be planned and run, see NIST SP 800-115, Technical Guide to Information Security Testing and Assessment.