The ninety-day retest is the only number that matters

Every report we write ends with a date ninety days out. On that date we run the same routes again, with the same tooling, and write down what happened.

It is the only number in the document that cannot be argued with. A finding count measures how hard we looked. A severity rating measures how we felt about it. The retest measures whether anything changed.

Roughly a third of high-severity findings are still exploitable at ninety days. Usually not because the fix was wrong, but because it was applied in one place and the same pattern existed in four.