Verifying defences.
WHAT IT EXAMINES
Whether the software can be made to behave in ways it should not.
WHAT THE APPROACHES ARE
Static analysis of code Dependency scanning Dynamic testing against a running system Manual assessment Penetration testing
WHAT STATIC ANALYSIS FINDS
Known dangerous patterns in code.
WHAT DEPENDENCY SCANNING FINDS
Known vulnerabilities in libraries you use.
WHY THAT IS THE HIGHEST-VALUE AUTOMATED CHECK
Most applications carry far more third-party code than their own, and known vulnerabilities are published.
WHAT TO RUN IT ON
Every build.
WHAT DYNAMIC TESTING FINDS
Problems visible only when running: configuration, authentication, session handling.
WHAT MANUAL ASSESSMENT FINDS
Business logic flaws.
WHY THOSE REQUIRE PEOPLE
They depend on understanding what should be impossible, which tools cannot know.
WHAT TO TEST FOR ROUTINELY
Injection in every input Authorisation on every resource Authentication weaknesses Session handling Sensitive data exposure Security configuration
WHAT TO PROVIDE AN ASSESSOR
The application's logic, roles, and what should be impossible.
WHAT TO PRIORITISE FINDINGS BY
Exploitability and impact.
