> For the complete documentation index, see [llms.txt](https://docs.alemba.com/asm-hermes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alemba.com/asm-hermes/readme/asm-security-and-compliance/security-penetration-test-reports/2025.md).

# 2025

#### Scope of the 2025 Assessment

The 2025 penetration testing engagement included:

* **Authenticated web application testing** of the Self-Service application
* **Unauthenticated web application testing** of the Nano and Service Manager applications
* Assessment from the perspective of:
  * Unauthenticated internet users
  * Standard authenticated users

Testing was performed remotely across multiple phases between **September and November 2025**, in line with recognised penetration testing methodologies .

{% file src="/files/Lc73yGICGaPE19WfNUKT" %}

***

#### Assessment Outcomes

The independent assessment provided:

* An objective evaluation of application security strengths and weaknesses
* A prioritised list of identified findings
* Practical remediation guidance aligned with security best practices

All identified findings were reviewed and addressed promptly. At the conclusion of the assessment and retesting cycle:

* **No critical, high, or medium-severity findings remained**
* **One low-severity finding and two informational items** were recorded
* The overall **final severity rating was assessed as *****Low***

These results demonstrate the effectiveness of our secure development practices and our commitment to timely remediation.