The typical security testing process first tests the application for vulnerabilities and then analyzes the results. Once a vulnerability is found, it must be reported before it can be fixed. Then, when the vulnerability has been fixed, a new round of penetration testing should be conducted to ensure that it was fixed correctly and those other vulnerabilities were not introduced.