Analysing Scope Risk in Vulnerability Assessment and Penetration Testing Methodology

In today's cybersecurity landscape, the traditional Vulnerability Assessment and Penetration Testing (VAPT) techniques often fail to detect complex, evolving threats, highlighting key limitations in current VAPT methodology. Effective VAPT necessitates a clearly defined test scope; limited scope may overlook critical vulnerabilities while broader scope may complicate procedures and deplete resources. This paper introduces an enhanced VAPT methodology incorporating the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework, offering a structured approach to simulate real-world attack scenarios. The iterative Attack Vector model improves adaptability, enhances detection accuracy and reduce response times by aligning assessments with adversary behaviors. Experiment results demonstrate the novel approach significantly improves vulnerability detection and remediation prioritization compared to traditional methods, increasing stages covered and realism of simulations. This methodology utilizes iterative scope refinement empowering organizations with actionable insights, response strategies and a stronger security posture. Future work emphasizes automating processes, incorporating additional frameworks and refining resource efficiency to meet evolving cybersecurity demands.