Security Assessment and Testing

This domain focuses on designing, performing, and analyzing security tests, vulnerability assessments, and audit results.

Application Security Testing (AST) Tools (SAST, DAST, SCA)

• • Scoping of the Definition: The foundational suite of tools used to automate security analysis within the Software Development Life Cycle (SDLC). These tools shift security left by embedding checks directly into the developer workflow to identify code flaws, runtime vulnerabilities, and open-source risks before deployment.

• • Definitional Technology, Feature, and Service Lines:

1. • 1. Static Application Security Testing (SAST): Analyzes source code (without executing it) to find flaws like buffer overflows or injection issues.
     2. Dynamic Application Security Testing (DAST): Tests running applications to identify vulnerabilities visible to an attacker, such as configuration errors and broken authentication.
     3. Software Composition Analysis (SCA): Scans third-party and open-source libraries for known vulnerabilities (CVEs) and license compliance issues.

Exposure Assessment Platforms (EAP)

• • Scoping of the Definition: A highly centralized operational hub designed to unify asset intelligence across hardware devices, human and non-human identities, software supply chains, SaaS applications, and physical infrastructure. The primary strategic imperative is to aggregate and deeply correlate unstructured asset data across these diverse sources, classifying inventory automatically and enriching it with dynamic threat context to solve the issue of critical vulnerabilities being siloed across discrete dashboards.
  • Definitional Technology, Feature, and Service Lines: Combines deep vulnerability discovery with profound business context to enable security teams to prioritize actions based on actual exploitability rather than theoretical CVSS risk scores. Delivers immediate context to answer questions regarding zero-day impact and the precise statistical probability of exploitation.

Penetration Testing (Pen Test)

• • Scoping of the Definition: A manual or automated simulated cyberattack against an organization’s system, application, or network to evaluate its security posture and identify exploitable vulnerabilities. Unlike vulnerability scanning, which merely finds flaws, penetration testing attempts to exploit them to demonstrate the real-world impact of a successful breach.
  • Definitional Technology, Feature, and Service Lines: Manual ethical hacking, red team exercises, internal and external network assessments, web application penetration testing, social engineering simulations, and formal reporting with prioritized, actionable remediation steps.