Use Case in Software Testing: How to Turn One Into Test Cases
Every path through a use case becomes at least one test case. A worked bank-transfer example shows the test table, and ISTQB's 2023 and 2025 syllabus changes explain…
Infrastructure and Network Security Testing Services
Vervali tests the infrastructure your application runs on: servers and operating systems, network devices and segmentation, firewall and access rules, cloud configuration and identity permissions, and the exposed services an attacker would find first. Findings are risk-ranked with a remediation path, and every engagement ends with a retest of the agreed in-scope assets.
150+ clients
450+ projects
275+ engineers
15+ years
ISO/IEC 17025:2017Accredited testing laboratory
CMMI Maturity Level 3The process is written down and repeats
ISO 9001:2015Quality management
ISO/IEC 27001Information security
What Infrastructure Security Testing Covers
Servers, network devices, cloud configuration and the things nobody patched: the layer your application runs on, not the application itself.
Servers and Operating Systems
Missing patches, default accounts, services that should not be listening, and configuration that still matches last year's build image. A finding looks like an unauthenticated service on an internal host, or a kernel that has been public for months. We check the agreed in-scope servers, not a neighbour you did not name.
Network Devices and Segmentation
Whether the diagram still matches the traffic. Routing, VLAN and trust boundaries, management planes left on the production network. A finding looks like a jump from a guest VLAN into a payment segment, or a device still using a community string from the install guide.
Firewall and Access Rules
Rules that were temporary and became permanent, any-any leftovers, and admin paths that should not be reachable from the internet. A finding looks like an old port still open for a vendor who left, or remote desktop on a host that was supposed to sit behind a jump box.
Cloud Configuration and Identity Permissions
IAM sprawl, public storage, security groups that drifted, and logging that is off on the account that matters. A finding looks like a bucket readable from the internet, or a role that can assume more than the ticket said.
Exposed Services an Attacker Finds First
What answers on the public surface of the agreed in-scope assets: VPN, mail, remote access, forgotten admin panels, and development hosts that still have a DNS name. A finding looks like a staging login on the internet, or a service banner that still names the version.
Find the unpatched host before an attacker does.
Free Exposure CheckInfrastructure Testing or Penetration Testing
Infrastructure testing is the network and host layer of the security offer. Pick the scope that matches the problem you have.
Choose Infrastructure Testing When
The problem is servers, segmentation, firewalls, cloud IAM and the services that answer on the internet. You want those agreed in-scope assets tested, a risk-ranked report and a retest. For deeper device, VPN and traffic review, pair it with network security testing.
Choose Penetration Testing When
You need an authorised attacker across the application, API, mobile and infrastructure, with controlled exploitation inside agreed limits. That is our penetration testing and VAPT engagement, part of the wider security testing offer. We do not bill both for the same week unless you asked for both.
Cloud Configuration Review
Most infrastructure now lives in cloud configuration, so that is where most of these findings come from.
Identity and Permissions
IAM sprawl, stale keys and roles that can assume more than the ticket said, on the agreed in-scope accounts. We say what we checked and what each finding looks like, so the owner can close it without a second meeting.
Storage and Network Exposure
Public buckets, snapshots shared too widely, and security groups that drifted from the design. A finding looks like a storage path readable from the internet, or a database port open to any address.
Logging and Compliance Evidence
Logging that is off on the account that matters. HIPAA, PCI DSS and SOC 2 readiness evidence is a separate engagement under cloud security and compliance. Vervali tests a client's systems for SOC 2 readiness and is not itself SOC 2 certified.
Method and Tools
A scan finds candidates. A person confirms each one before it becomes a finding.
Recon and Enumeration
What answers on the agreed in-scope assets, from the outside and from the segments you named. OpenVAS and Tenable widen the first pass. Wireshark is for the traffic that the diagram said should not exist.
Manual Verification
Every high and critical is confirmed by a person before it is a finding. False positives stay out of the report. That is the step a weekend scan skips, and the step an engineer will actually trust.
Controlled Exploitation
Metasploit and manual follow-up only inside the agreed limits. Proof that the path is real, not a smash of production. If a step would take a service down, we stop and write what we would have done.
What the Report Contains
One report for three readers: engineers who fix, leaders who set the order, and auditors who check scope.
Every Finding
Risk-ranked with a stated basis, the reproduction, the evidence and the remediation path. Enough for an engineer to fix it without asking what the scanner meant.
The Summary That Matters
A short summary that names the two or three things that would actually cause harm, so a CISO does not have to mine a 60-page appendix. A critical finding is never buried on page 47 because the scanner numbered it that way.
Mapped to Scope
An auditor gets a list that maps to the agreed in-scope assets. Recovery of backups and failovers is a separate check through disaster recovery testing.
Retesting
Every engagement ends with a retest of the agreed in-scope assets, included in the original work.
When It Runs
Schedule it once your owners say the fixes are in. Findings are revalidated after your team fixes them, and the retest is part of the original work rather than a second sale.
What It Covers
Every agreed in-scope asset from the first pass is checked again, with a pass or fail on each finding. If a new release changes the surface, that is a new scope, not a free extension of the last one.
Frequently Asked Questions
Testing of the agreed in-scope hosts, network and configuration: servers and operating systems, segmentation, firewall and access rules, cloud IAM, and the services an attacker finds first. Findings are risk-ranked with a remediation path. Every engagement ends with a retest of the agreed in-scope assets. It is not an application pentest and not a certificate. Delivery is in US hours from India, under ISO/IEC 27001.
Infrastructure testing covers hosts, network and configuration: servers, segmentation, firewalls, cloud IAM and exposed services. A penetration test is the full engagement across applications, APIs, mobile and infrastructure, with controlled exploitation inside agreed limits. Choose infrastructure testing when the problem is the estate under the application, and penetration testing when you need an authorised attacker across the product. Both end with a retest of the agreed in-scope assets.
Unpatched services, default accounts, trust boundaries that do not hold, firewall rules that were supposed to be temporary, public storage, IAM roles that can assume too much, and forgotten admin panels on the internet. Each finding is verified by a person. A version banner without a path to harm is not reported as critical. Tools on the work include Tenable, OpenVAS, Metasploit and Wireshark.
Price follows the agreed in-scope set: how many hosts, network segments and cloud accounts, whether exploitation is included, and the retest that is part of the work. We quote once that list is written down, and typical work starts at $25 to $49 per hour. A free external exposure check on one domain gives you a first look from the outside before you commit.
After a material change: a new segment, a cloud account, a VPN, or a lift of production hosts. On a quiet estate, a yearly pass of the agreed in-scope assets is the floor many auditors expect. After a finding is fixed, the retest is part of that engagement, not a reason to wait a year. If releases change the surface every sprint, say so in the design so the cadence matches the estate.
Yes. We review IAM sprawl, public storage, network exposure and logging on the agreed in-scope cloud accounts, alongside servers and network devices. Where you need HIPAA, PCI DSS or SOC 2 readiness evidence for an auditor, that runs as a separate cloud security and compliance engagement. Vervali tests a client's systems for SOC 2 readiness and is not itself SOC 2 certified.
Most breaches that start on infrastructure start on something that was already reachable: an unpatched service, a segment that was not a segment, a key that was never rotated. This work finds those paths on the agreed in-scope assets and proves which ones matter, then retests the fix. It does not make a promise that an attacker will never arrive. It shrinks the obvious doors before someone else walks through them.
Yes. Every engagement ends with a retest of the agreed in-scope assets. Findings are revalidated after your team fixes them, with a pass or fail on each, and that retest is part of the original work rather than a second sale. If a new release changes the surface, that is a new scope, not a free extension of the last one.
Any team that runs servers, a network or a cloud account an attacker could reach, and that has to show a retest of the agreed in-scope assets. Finance, healthcare, travel and public-sector buyers ask because an auditor or a customer questionnaire named the estate, not because the industry is special. The method is the same. The in-scope list is what changes.
Email Us
Call Us
