Security testing
Choose, scope and commission a security assessment, interpret its findings and verify that the fixes work.
A useful security test starts with a decision you need to make. You might need to know whether two customer accounts are properly separated, whether a new service is ready for release, or whether your team can detect a realistic intrusion. Those questions call for different work.
This section takes you from choosing an assessment to closing its findings. It is written for service owners, technical leads and people buying testing for a UK organisation. The examples are fictional and the working documents are editorial tools, not certificates of assurance.
Choose your starting point
| Your immediate task | Read | What you will leave with |
|---|---|---|
| Decide which assessment answers your question | Assessment types | A comparison and three explained choices |
| Agree the assets, permissions and limits | Scoping and authorisation | A worked scope and a list of decisions to resolve |
| Compare testing proposals | Choosing a provider | Questions and an evidence-based comparison sheet |
| Turn a report into work your team can do | Reading a report | An annotated finding and report-review checklist |
| Decide what to fix first | Prioritising remediation | A sample backlog with reasons, owners and review points |
| Establish whether a fix is effective | Retesting | A verification plan and a completed closure record |
A practical commissioning sequence
For a fictional customer portal, the owner first writes: “We need evidence that one customer cannot retrieve another customer's documents.” That question identifies the relevant user roles and business functions. A scope then identifies the test environment, representative data and allowed actions. The provider's proposal should explain how its work will answer the question. The report should show the coverage and its limits; the service team should own the resulting improvements.
Reserve time and funding for that final stage. A report left in an inbox does not change the service. Use the scope worksheet to capture reporting and retest expectations before work starts.
Understand the limits of a test
The NCSC's commissioning guidance treats penetration testing as one part of vulnerability management. Its conclusions are bounded by the systems, access and period examined. Routine maintenance, secure development and monitoring continue between assessments.
An assessment that excludes customer administration cannot answer questions about that function. A test of a representative environment also needs an explanation of any differences from production. Record those limitations with the decision the report informs.
Historical context
The 2018 conference archive includes a documented red-teaming presentation. Historical material can introduce useful questions, while these guides provide a separate, newly written route through commissioning and follow-up. The historical speakers are not the authors or endorsers of this guidance.
Sources and further reading
- NCSC: Penetration testing — checked 2 November 2026