Penetration testing

Manual attack by a skilled tester against a defined scope.

Mandatory for 39 of 46 product types. Usually run by a external lab.

What it catches

• logic flaws
• chained vulnerabilities
• auth bypass

What it misses

• issues outside scope
• future regressions

Which product types need it and why

Done conditions used on playbook pages

Each mandatory cell has its own done condition, written for that product type.

• accounting and invoicing SaaS (Fintech): An external tester cannot log in by guessing common passwords, and cannot read another company's ledger by changing an organisation ID.
• buy now pay later service (Fintech): An external tester cannot view another shopper's purchases by changing an order ID, and cannot open a plan that bypasses the identity check.
• clinical trial management software (Healthcare): A blinded site user and a sponsor monitor each try to read the treatment arm or another site's participants by changing ids, and both attempts fail.
• crypto exchange (Fintech): An external tester cannot approve a withdrawal from the hot or multisig wallet without the required signers, and cannot read another customer's account from the support console.
• dating app (Consumer apps): A tester with a second account cannot read another member's private photos, exact location or messages, and cannot create profiles in bulk through the API.
• desktop application (Infrastructure and developer products): A hostile web page opened in each supported browser cannot launch the app, join a session or read app data through a local port or URL handler.
• e-signature service (B2B SaaS): A tester with a forwarded or edited signing link cannot open another signer's document, an access code or SMS check cannot be skipped by replaying the link.
• ecommerce store (Commerce): A tester signed in as one shopper cannot see another shopper's orders, addresses or saved cards by changing an order or customer id.
• email marketing platform (B2B SaaS): A tester holding a staff support account cannot export a customer's audience or change its sending domain without a logged customer approval.
• ERP system (B2B SaaS): An unauthenticated tester cannot reach any file, report or servlet behind the supplier or employee self-service portal.
• expense management tool (Fintech): An external tester cannot open another team's receipts by changing an ID, and cannot raise their own card limit or approve their own report.
• fleet and logistics tracking (Infrastructure and developer products): A tester holding one fleet's account and a list of device IDs cannot see another fleet's vehicles or send any command, including engine cut-off, to a tracker.
• government services portal (Public sector): A tester signed in as one citizen cannot view another person's case or documents by changing an ID, and cannot bypass identity proofing to file a claim.
• grocery delivery app (Commerce): The tester's report states they could not read another household's address, doorstep notes or order history from a shopper or picker account.
• identity and access management service (B2B SaaS): A tester holding a HAR file or copied session cookie from a support ticket cannot reuse it to reach the admin console, and replay from a new device and IP is refused.
• insurance app (Fintech): An external tester cannot extract licence numbers from the quote or agent tools, and the agent portal refuses login without a second factor.
• smart home or IoT app (Infrastructure and developer products): A tester with a leaked password list, a second account and access to the same Wi-Fi cannot view a camera feed, speak through it or change settings on a device they do not own.
• lending platform (Fintech): An external tester cannot open another borrower's loan file by changing an ID, and cannot submit an application that skips the identity check.
• LLM-based assistant (Infrastructure and developer products): A tester planting instructions in an uploaded file or a retrieved page cannot make the assistant call a tool, reveal its system prompt or show another user's data.
• loyalty program app (Commerce): A tester replaying leaked password lists is throttled and blocked, and cannot read or redeem another member's balance by changing an account number.
• online marketplace (Commerce): A tester signed in as seller A cannot read seller B's buyers, orders or payout account, or change another seller's bank details, by editing ids, and a seller account set up with a tax ID that does not match the seller's verified name cannot receive a payout.
• mental health app (Healthcare): A tester signed in as one user cannot read another user's journal, chat or intake answers by changing an ID in a request.
• messaging app (Consumer apps): A tester with one account cannot fetch another user's attachment by guessing its link, cannot read another user's chat history from the server, and finds no chat content in the phone's shared storage or unprotected backup.
• machine learning model service (Infrastructure and developer products): A tester with one client key cannot read another client's predictions, logs or training data through the API.
• mobile banking app (Fintech): An external tester logged in as customer A cannot open customer B's transactions, statements or payees by changing account identifiers in app requests.
• neobank (Fintech): An external tester cannot download another applicant's ID photo or selfie, and cannot reuse a passed ID check to open a second account.
• peer-to-peer payment app (Fintech): An external tester cannot take over a test account through password reset, SIM swap simulation or session reuse, and cannot read another user's private payments.
• patient portal (Healthcare): A tester signed in as one patient or proxy cannot open another patient's results, messages or documents by changing an ID or replaying a link.
• pharmacy delivery app (Healthcare): A tester signed in as patient A cannot read patient B's prescriptions, insurance card or delivery address by changing an order or patient id.
• ride-hailing app (Commerce): A tester cannot read another rider's trips, cannot reach driver documents from a support or contractor account, and cannot log a trip with a spoofed location.
• software as a medical device (Healthcare): A tester within radio range or on the network cannot read therapy history or send a setting to the test device without pairing credentials.
• social network (Consumer apps): A tester cannot obtain or reuse another user's session token through profile previews, shared links or the API, and a password reset signs every old session out.
• subscription box service (Commerce): A tester cannot read another subscriber's address or order history by changing a subscription id or guessing gift codes.
• telemedicine app (Healthcare): A tester logged in as patient A cannot open patient B's visit notes, prescriptions or chat, and a deactivated clinician account cannot open any chart.
• event ticketing platform (Commerce): The tester's report states that scripted buyers could not exceed the per-buyer ticket limit across accounts or open another buyer's ticket by changing an order number.
• stock trading app (Fintech): An external tester cannot place an order or change the linked bank in another customer's account, and support tooling cannot export account data without a second approver.
• travel booking app (Commerce): The tester's report states they could not open another traveller's trip or passport details by guessing or changing a booking reference.
• video conferencing tool (B2B SaaS): A tester without an invite cannot join a passcode or waiting-room meeting by guessing IDs, and cannot open a cloud recording link without signing in as an allowed user.
• wearable companion app (Healthcare): A tester with a second phone in range cannot pair with, read data from or send commands to a band already paired to another account.

Tools

Alphabetical. Not recommendations.