Security testing guides & methodologies

A penetration test moves through defined phases: scoping and rules of engagement, reconnaissance, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting, with each phase producing evidence that maps to a recognized framework such as PTES or NIST 800-115.

API penetration testing focuses on authorization and authentication flaws that scanners miss, using the OWASP API Security Top 10 as the reference model, with Broken Object Level Authorization (BOLA) as the most common and highest-impact class of issue.

Scoping a penetration test defines exactly which assets and environments are in bounds, the testing perspective (black, grey, or white box), and the rules of engagement, so the test is authorized, safe, and focused on the risks that matter.

AI security testing evaluates LLM-backed applications against the OWASP Top 10 for LLM Applications and adversarial techniques catalogued in MITRE ATLAS, treating the model, its data, its integrations, and its output handling as distinct attack surfaces.

Prompt injection testing verifies whether untrusted input can override an LLM application's instructions, covering direct injection in user input and indirect injection through content the model retrieves, mapped to OWASP LLM01 and mitigated by treating all model input and output as untrusted.

A cloud security assessment reviews identity and access management, network exposure, storage configuration, logging, and encryption against recognized baselines such as the CIS Benchmarks, ideally validated continuously through cloud security posture management (CSPM).

ISO 27001 readiness requires a defined ISMS scope, a documented risk assessment and treatment plan, a Statement of Applicability justifying each Annex A control, and evidence that the selected controls operate effectively before a certification audit.