Security · Mixed

Security testing: what to order and when

In one line: Automated scanning is ongoing hygiene; a penetration test is a focused event — and both need a written objective.

Three levels

Automated scanning. Dependencies, configuration, and basic app scanning. Runs on every build.

Focused code review. On sensitive areas — authentication, permissions, payments, uploads.

Penetration test. By an external party, before a significant launch or an architectural change.

How to order correctly

Define a clear scope, provide access and test accounts, and ask for a report ranked by business risk and not just technical severity. Ask for a retest after the fixes too — a finding not confirmed as closed stays open.

What to do with the report

Not everything gets closed. Rank, assign an owner and dates, and document a conscious decision about what remains. A report gathering dust in a drawer is worse than a test never done — it's evidence you knew.

Going deeper

Add business-logic tests to the pipeline, not just generic vulnerability tests: whether a user can change a price, skip an approval step, or view another's resource. That's where the truly valuable findings are, and automated tools almost never find them.

Security Testing

Next: Security in model-based systems · Previous: Team safety: where most breaches start · Back to library