Why is there no 30-day follow-up like the external VISTA?
The internal testing is completely different from external testing. External vulnerabilities are quickly resolved; however, internal vulnerabilities require network administrator time to ensure that correcting the internal vulnerability does not take down the system or make core applications non-functional. As such, an institution may have to operate with a vulnerability internal but at least the vulnerability is known and can be monitored. Our experience has shown that 30 days is not enough time for network administrators to properly assess and correct internal vulnerabilities. To allow you efficient time to evaluate the internal test results on your schedule, we offer additional testing over a year at a reduce fee from the initial testing.
