---
title: "A2: Remediation and Verification"
canonical: https://openvapt.com/academy/a2.html
html: https://openvapt.com/academy/a2.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A2: Remediation and Verification

Fixing findings safely, proving the fix worked, and tracking progress over time.

- Level: Applied
- Time: about 20 minutes
- Read first: A1

## You Will Be Able To

- Apply a fix with change control and a rollback plan.
- Verify a fix with a targeted re-scan.
- Track progress with report diffs.

## Fix Safely

Every check gives exact fix steps and cited sources. Apply one change at a time, test it, and keep a way back. Configuration changes to SSH or firewalls can lock you out of a remote server; keep a second session open.

## Verify

Each check has a verification command. Then re-run just that check: openvapt scan --only HOST-SSH-001. A fix is not done until it is verified.

## Track

Keep each report.json and compare with openvapt diff old.json new.json, or scan with --baseline old.json. The diff lists what was fixed, what is new and what is still open.

## In Summary

Fix the highest risk and the easiest wins first. Change one thing at a time, with a way back. Verify with a targeted re-scan and a diff.

## Apply It

- [HOST-SSH-001 SSH Allows Direct Root Login](https://openvapt.com/checks/HOST-SSH-001.md) (high)

## Lab

1. `Run: openvapt demo --lab vulnerable --out before && openvapt demo --lab hardened --out after`
2. `Run: openvapt diff before/report.json after/report.json`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. When is a fix complete?
   - A. When the configuration file is saved
   - B. When it has been verified, for example by a targeted re-scan
   - C. When the ticket is closed
   - D. When the service restarts
   - Answer: B. Verification proves the fix. A saved file or a restart does not.

2. What does openvapt diff show?
   - A. Fixed, new and still open findings between two reports
   - B. Source code changes
   - C. Network traffic
   - D. Changes in every file on the disk
   - Answer: A. It compares two JSON reports.

3. Why keep a second SSH session open while changing SSH or firewall settings?
   - A. To save time
   - B. So you can undo a change that locks you out
   - C. To make the scan faster
   - D. To log more detail
   - Answer: B. A bad SSH or firewall change can lock you out of a remote server. The open session is your way back.

4. Which command re-runs only one check?
   - A. openvapt scan --only HOST-SSH-001
   - B. openvapt diff old.json new.json
   - C. openvapt verify report.json
   - D. openvapt scan --dry-run
   - Answer: A. --only limits the scan to the checks you name.

5. How many changes should you apply at once?
   - A. All of them together
   - B. One at a time, tested, with a way back
   - C. As many as fit in the maintenance window
   - D. Only the Low findings first
   - Answer: B. One change at a time shows which change caused a problem and makes rollback simple.

## Key Terms

- Remediation: Fixing a weakness or reducing its risk to an acceptable level.
- Verification: Confirming that a fix actually removed the weakness.
- Change Management: A controlled process for making changes to systems, with testing, approval and a way to roll back.
- Baseline: A previous report or known-good state used for comparison, so changes and regressions can be seen.

## References

- [NIST SP 800-40 Rev. 4, Enterprise Patch Management](https://csrc.nist.gov/pubs/sp/800/40/r4/final)

Offline: `openvapt learn A2`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a2.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.