Skip to content

How to Submit VAPT Reports to Accops Security Team

Applies To: All Accops Products

Category: Security Reporting & Compliance

Document Status: Active

Overview

This guide provides systematic procedures for submitting Vulnerability Assessment and Penetration Testing (VAPT) reports to the Accops Security Team. Following these standardized submission procedures ensures faster resolution times, reduces back-and-forth communication, and helps strengthen product security across the entire Accops ecosystem.

Key Benefits:

  • Faster Resolution: Properly formatted reports reduce processing time by 60%.

  • Efficient Communication: Complete submissions eliminate multiple follow-up requests.

  • Priority Handling: Well-documented vulnerabilities receive immediate attention based on established SLAs.

  • Security Enhancement: Your contributions directly improve product security for all users.

Process Overview: This procedure outlines the steps for vulnerability identification, information gathering, report formatting, and submission through official Accops support channels.

Prerequisites

System Access Requirements

  • Accops Product Access: Administrative privileges on affected systems

  • Testing Environment: Isolated environment for vulnerability reproduction

  • Support Portal Access: Account credentials for support.accops.com

Required Information

  • Product Details: Exact Accops product names and version numbers

  • Environment Information: System configurations and patch levels

  • Vulnerability Data: Testing results, reproduction steps, and impact assessment

  • Vulnerability Scanners: Automated scanning tools for initial discovery

  • Documentation Tools: Screenshots, packet captures, or testing evidence

  • Network Analysis: Tools for network-based vulnerability assessment

Important Prerequisites

⚠️ Critical Requirements:

  • Remove false positives from automated scan results before submission.

  • Validate OS package vulnerabilities using HySecure validation procedures.

  • Ensure testing is conducted in non-production environments when possible.

  • Obtain appropriate authorization for penetration testing activities.

Procedure Part 1: Vulnerability Identification and Analysis

Step 1: Conduct a Thorough Analysis

  1. Execute Vulnerability Assessment

    • Perform comprehensive vulnerability scans using appropriate tools.

    • Focus on specific Accops products and their components.

    • Document scan parameters and methodology used.

  2. Eliminate False Positives

    • Review automated scanner results for accuracy.

    • Cross-reference findings with known patching status.

    • Validate OS package vulnerabilities using official Accops validation procedures.

    • Remove self-exploitation scenarios and invalid findings.

  3. Prioritize Findings

    • Rank vulnerabilities by severity and exploitability.

    • Focus on issues with demonstrable security impact.

    • Consider the business context and potential attack scenarios.

Step 2: Validate Vulnerability Scope

In-Scope Vulnerabilities:

  • Authentication and authorization bypass issues.

  • Data exposure or information disclosure vulnerabilities.

  • Remote code execution and privilege escalation flaws.

  • Cross-site scripting (XSS) with demonstrable impact.

  • SQL injection and command injection vulnerabilities.

  • Cross-site request forgery (CSRF) on critical functions.

Out-of-Scope Issues:

  • Self-exploitation scenarios (self-XSS, cookie reuse, self-DOS).

  • Attacks requiring man-in-the-middle or physical access.

  • Clickjacking on non-sensitive pages without a meaningful exploit.

  • CSRF vulnerabilities in non-critical actions.

  • Blind SSRF without working proof of concept.

  • Missing security headers without direct impact.

  • Version-based vulnerability claims without proof of concept.

  • Invalid/missing SPF/DKIM records without demonstrated risk.

  • Disclosure of static resources or public information.

  • Security weaknesses without practical impact.

Verification Checkpoint

  • Automated scan results reviewed and validated.

  • False positives eliminated using official validation procedures.

  • Vulnerability scope confirmed against exclusion criteria.

  • Findings prioritized by severity and business impact.

Procedure Part 2: Information Gathering and Documentation

Step 1: Collect Environment Information

  1. Product Version Details

    • Check version details from the HySecure Management Console.

    • Check hotfix details in Logs > Admin Logs (See what the last patch applied).

    • Required Information:

      • Exact Accops product name and version number.

      • Build number and release date.

      • Installed patches and hotfixes applied.

  2. System Configuration

    • Operating system version and patch level.

    • Network configuration and topology.

    • Integration points with other systems.

    • Custom configurations or modifications.

Step 2: Document Vulnerability Details

Essential Information Required:

  1. Clear Vulnerability Description

    • Concise summary of the security issue

    • Technical explanation of vulnerability

    • Reference to applicable CVE identifiers, if available

  2. Affected Components

    • Specific module, system, or feature impacted

    • User roles or privilege levels affected

    • Network services or interfaces involved

  3. Detailed Reproduction Steps

    • Step-by-step instructions to reproduce the issue

    • Required test data, payloads, or configurations

    • Expected vs. actual behavior observed

    • Screenshots or packet captures supporting findings

  4. Impact Assessment Analysis

    • Data Risk Evaluation:

      • What information could be accessed or compromised

      • Types of data at risk (credentials, personal information, business data)

      • Scope of potential data exposure

System Impact Analysis

  • Which systems or users might be affected

  • Potential for lateral movement or privilege escalation

  • Service availability or operational impact

Exploitability Assessment

  • Technical skill level required for exploitation

  • Access requirements (network, physical, application-level)

  • Conditions necessary to trigger the vulnerability

  • Availability of public proof-of-concept exploits

Attack Scenario Description

  • Actions an attacker could perform after successful exploitation

  • Potential business impact and regulatory implications

  • Detectability of exploitation attempts

Step 3: Prepare Supporting Evidence

  1. Proof of Concept Development

    • Create a working demonstration of the vulnerability

    • Document exploitation steps clearly and completely

    • Include necessary code, scripts, or testing tools

    • Ensure the Accops team can safely reproduce PoC

  2. Evidence Collection

    • Screenshots showing vulnerability exploitation

    • Network packet captures demonstrating attack traffic.

    • Log files showing exploitation attempts or success.

    • Before/after comparisons showing security impact.

Documentation Quality Standards

  • All required information fields completed

  • Reproduction steps tested and verified

  • Supporting evidence collected and organized

  • Impact assessment is comprehensive and accurate

Procedure Part 3: Report Formatting and Submission

Step 1: Use Standardized Report Format

  1. Access Official Template

    • Download Sample VAPT Report Sheet

    • Complete all required fields thoroughly

    • Ensure consistent formatting and organization

  2. Organize Information Systematically

    • Section 1: Environment and product information

    • Section 2: Vulnerability details and description

    • Section 3: Reproduction steps and methodology

    • Section 4: Impact assessment and risk analysis

    • Section 5: Supporting evidence and proof of concept

Step 2: Quality Review and Validation

  1. Technical Accuracy Review

    • Verify all technical details are correct

    • Confirm reproduction steps work as documented

    • Validate impact assessment conclusions

    • Review supporting evidence for completeness

  2. Completeness Check

    • Ensure all required information fields are populated

    • Verify proof of concept is included and functional

    • Confirm supporting evidence is clear and relevant

    • Check that the vulnerability scope aligns with the inclusion criteria

Step 3: Submit Through Official Channels

Primary Submission Method: Support Portal

  1. Access Accops Support Portal

    • Navigate to support.accops.com

    • Log in with authorized account credentials

    • Select the Submit New Ticket option

  2. Create VAPT Report Ticket

    • Choose "Security Vulnerability Report" category

    • Include "VAPT Report" in the ticket subject line

    • Attach completed report template and supporting evidence

    • Provide contact information for follow-up questions

Alternative Submission Method: Email

If support portal access is unavailable:

  • Send report to support@accops.com

  • Use subject line: "VAPT Report - [Product Name] - [Severity Level]"

  • Include all required documentation as attachments

  • Request confirmation of receipt

Submission Verification

  • Report submitted through official Accops support channels

  • Confirmation of receipt obtained

  • Ticket number recorded for tracking

  • Contact information provided for follow-up

Service Level Agreements and Response Times

Accops Commitment to Vulnerability Resolution

For Accops Product Vulnerabilities:

Priority Level Resolution Timeline Description
Critical 15 days Immediate threat to system security requiring emergency response.
High 30 days Significant security risk with potential for data compromise.
Medium 60 days Moderate security risk requiring planned remediation.
Low 180 days Minor security issues with minimal immediate impact.

For Third-Party and Open-Source Components:

Priority Level Resolution Timeline Description
Critical 15 days post-fix availability Resolution is dependent on the upstream vendor patch release.
High 30 days post-fix availability Coordinated response with third-party security updates.
Medium 60 days post-fix availability Planned integration of upstream security patches.
Low 180 days post-fix availability Routine update cycle for non-critical components.

Priority Determination Criteria

Critical Priority Indicators

  • Remote code execution without authentication

  • Complete system compromise possible

  • Widespread data exposure potential

  • Active exploitation in the wild

High Priority Indicators

  • Privilege escalation vulnerabilities

  • Authentication bypass mechanisms

  • Significant data disclosure risks

  • Network-based attack vectors

Resolution Options

  • Mitigation: Temporary protective measures or configuration changes.

  • Permanent Fix: Complete resolution through product updates or patches.

  • Workaround: Alternative procedures to minimize risk exposure.

Note

Priority determination is based on vulnerability severity, exploitability, and impact specific to Accops products and deployment scenarios.

Product Updates and Security Maintenance

Recommended Practice: Use the latest Accops product versions to minimize known vulnerabilities. Access updates at Accops Product Downloads.

Troubleshooting and Common Issues

Critical Issues and Resolutions

Issue 1: Support Portal Access Problems

  • Symptoms: Cannot log in to support.accops.com

  • Resolution: Reset password, contact account management, or use email submission.

Issue 2: Large File Attachment Issues

  • Symptoms: Cannot upload supporting evidence files.

  • Resolution: Compress files, use a file sharing service, or contact support for alternatives.

Issue 3: False Positive Identification

Issue 4: No Response to Submission

  • Symptoms: No acknowledgment after 48 hours.

  • Resolution: Check spam folders, contact support@accops.com directly, or resubmit.

Escalation Procedures

  • Level 1: Initial troubleshooting attempts.

  • Level 2: Contact Accops technical support.

  • Level 3: Escalate to security team management.

Reference Materials and Support

Documentation Resources

Support Contacts

Important

Critical Requirements:

  • Always validate OS package vulnerabilities before submission to prevent false positives.
  • Include working proof of concept when possible to facilitate rapid resolution.
  • Maintain strict confidentiality throughout the vulnerability disclosure process.

Best Practices:

  • Review and validate automated scanner results thoroughly before submission.

  • Use the latest Accops product versions to minimize known vulnerability exposure.

  • Submit complete reports with all required information to minimize processing delays.

Contact Support: support@accops.com for assistance with VAPT submissions and security-related inquiries.