Is a retest included?

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

It depends on the firm, so ask before signing. A retest is the tester confirming your fixes closed each finding, and it is the part a customer or auditor most wants to see. Many firms include one retest within 30 to 90 days of the report; some charge a day or two extra. Plan your fixes inside the window.

Why it matters

A report with ten open findings is evidence of problems. The same report with every high finding marked fixed and verified is evidence of a working security process. Buyers read the retest column first.

What to ask

• Is a retest included, and within what window?
• Does it cover all findings or only critical and high?
• Is the updated report reissued with retest status?
• What does a second retest cost?

Planning fixes

Fix critical and high findings first, then send the list back. With an AI tool doing the edits, most small apps fix within two weeks. See reading the report.

Getting the most from a retest

Send the tester a list of each finding with what you changed and when it was deployed. Make sure the fixes are on the environment being retested, and that test accounts still work. Fix the root cause rather than the specific example: if the finding was "order 1040 readable by another user", the retest will try other orders and other record types too.

Ask for the updated report to show each finding as fixed, partially fixed or open, with the retest date. Accept any finding you decide not to fix in writing, with a reason and a date to revisit, so the report tells a buyer you made a decision rather than ignored it.

Getting it checked

TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.

Related questions

• Can the report be used for SOC 2?
• How often should we retest?
• Questions to ask a testing firm

Common questions