The end of the penetration test report had a 'high' risk flag — how serious is this?

sql injection is a big deal connection encryption etc and like counts as low. if it were me i'd fix the high risks this week

Your report has an 'executive summary' page. At the top of the page, it lists how many High and how many Medium. Start there.

Some firms artificially inflate risk scores to jack up the 're-test' fee. If it says SQL injection, open the code and check if it's actually there or not.

so should i not fix all risks immediately, or are high risks enough?

Within the risk management framework, closing vulnerabilities rated as High is a legal compliance requirement. Even if you have a cyber insurance policy, coverage may be voided if you fail to close vulnerabilities you were explicitly warned about.

The opposite happened to me, that's why I'm writing. Hasty decisions become decisions you have to fix six months later.

Good luck with that.

I went through the same thing two years ago. If you scold false alarms, nobody will report again.

That's all, sorry if I went on too long.

I went through the same thing two years ago. Processes without records never improve, because you don't know what to fix.

Proven by experience.

I agree.

Three different views emerged, they all complement each other. Most time waste accumulates in tasks waiting for approval.

If I were you, I'd go this route.

let me summarize what's been said so far then just becasue everyone does it doesn't mean it's right.

good luck with that.

I didn't know that.

Following.

Thanks, that was the answer I was looking for.

Timely topic.

Thanks a lot, I'll try it today.

We experienced almost the exact same thing last year. Taking notes for two weeks yields better results than a six-month estimate.

Solutions that work at a small scale collapse when you grow; I learned this late. Hope this helps.

noted, thanks.