Skip to Content
OpenVAPTAlpha
Cite
Pre-release. Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. Free for your own use, 100% at your own risk. This website collects no data. Read MoreRead Less
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
A2AppliedAbout 20 minutes

Remediation and Verification

Fixing findings safely, proving the fix worked, and tracking progress over time.

OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/a2.html. Offline: openvapt learn A2.

Read First: A1

You Will Be Able To

  • Apply a fix with change control and a rollback plan.
  • Verify a fix with a targeted re-scan.
  • Track progress with report diffs.

Fix Safely

Every check gives exact fix steps and cited sources. Apply one change at a time, test it, and keep a way back. Configuration changes to SSH or firewalls can lock you out of a remote server; keep a second session open.

Verify

Each check has a verification command. Then re-run just that check: openvapt scan --only HOST-SSH-001. A fix is not done until it is verified.

Track

Keep each report.json and compare with openvapt diff old.json new.json, or scan with --baseline old.json. The diff lists what was fixed, what is new and what is still open.

In Summary

Fix the highest risk and the easiest wins first. Change one thing at a time, with a way back. Verify with a targeted re-scan and a diff.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

CheckTitleSeverity
HOST-SSH-001SSH Allows Direct Root LoginHigh

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

  1. Run: openvapt demo --lab vulnerable --out before && openvapt demo --lab hardened --out after
  2. Run: openvapt diff before/report.json after/report.json

Check Yourself

Answers are checked in your browser and never stored or sent.

Question 1

1. When is a fix complete?

Question 2

2. What does openvapt diff show?

Question 3

3. Why keep a second SSH session open while changing SSH or firewall settings?

Question 4

4. Which command re-runs only one check?

Question 5

5. How many changes should you apply at once?

References

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

Cite This Page

If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.

APA 7
OpenVAPT. (2026). A2: Remediation and Verification (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a2.html

In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

BibTeX
@misc{openvapt_a2,
  author       = {{OpenVAPT}},
  title        = {{A2: Remediation and Verification}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/a2.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}

Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.

Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.

Previous: A1 Running an Assessment Next: A3 Reporting and Communication

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt