Penetration Testing and Vulnerability Management

Penetration testing

Vantrel Plan is tested by an independent third-party security firm at least once a year, and additionally before major architectural changes. Tests cover the web application, the public API and the external infrastructure, using a grey-box approach.

The most recent penetration test was completed in March 2026. It identified no critical findings and two high-severity findings, both remediated within 30 days and verified by the testing firm during a retest.

An executive summary of the latest penetration test report can be shared with customers under NDA. The full report is not shared.

Customers may perform their own penetration tests on their workspace only with Vantrel's prior written approval.

Vulnerability management

Vantrel scans its infrastructure, container images and application dependencies continuously. Vulnerabilities are prioritized using CVSS scores and exploitability, and must be remediated within the following timelines:

Severity	Remediation deadline
Critical	7 days
High	30 days
Medium	90 days
Low	Best effort

Exceptions must be documented, include compensating controls, and be approved by the CISO.

Patch management

Operating system and container base images are rebuilt and redeployed at least weekly to include the latest security patches.