This page answers the coverage question three ways: which published standards the methodology maps onto, which platforms and surfaces it spans, and how much of the work at each point is done by hand rather than by a scanner.
Every identifier quoted anywhere in this section is checked against the published control list it belongs to before it is published. Where a test has no defensible mapping, none is given rather than an approximate one.
- 42Category pages
- 276Test cases
- 981Verified control references
- 71%Fully manual
The catalogue lists 46 categories; they occupy 42 pages, because four categories are tested on both Android and iOS and share a page between them. A further 77 cases (28%) are hybrid — a tool sweeps and a person does the part the sweep cannot reach — and 4 are performed by tooling alone.
Standards coverage
The methodology is mapped onto five published references. The counts below are the number of distinct identifiers from each that appear across the test cases.
| Reference | Full name | Identifiers used |
|---|---|---|
| WSTG | OWASP Web Security Testing Guide | 89 |
| ASVS | OWASP Application Security Verification Standard | 72 |
| MASVS | OWASP Mobile Application Security Verification Standard | 23 |
| LLM | OWASP Top 10 for LLM Applications (2025, v2.0) | 10 |
| CWE | Common Weakness Enumeration | 161 |
Where a client works to a standard not listed here, the mapping is produced for the engagement rather than claimed in advance.
Coverage by category
Categories down the page, with the number of test cases each contains, the standards its cases reference, and the balance of manual and automated work within it.
Web Applications — 107 test cases across 13 pages
| Category | Test cases | Standards | Depth |
|---|---|---|---|
| Information Gathering | 10 | WSTG · ASVS · CWE | 2 manual · 7 hybrid · 1 automated |
| Configuration and Deployment Management Testing | 12 | WSTG · ASVS · CWE | 5 manual · 6 hybrid · 1 automated |
| Authentication Testing | 13 | WSTG · ASVS · CWE | 9 manual · 4 hybrid |
| Authorization Testing | 4 | WSTG · ASVS · CWE | 3 manual · 1 hybrid |
| Session Management Testing | 8 | WSTG · ASVS · CWE | 4 manual · 3 hybrid · 1 automated |
| Data Validation Testing | 20 | WSTG · ASVS · CWE | 13 manual · 7 hybrid |
| Error Handling | 2 | WSTG · ASVS · CWE | 2 hybrid |
| Cryptography | 3 | WSTG · ASVS · CWE | 1 manual · 1 hybrid · 1 automated |
| Business Logic Testing | 8 | WSTG · ASVS · CWE | 7 manual · 1 hybrid |
| Client Side Testing | 11 | WSTG · ASVS · CWE | 7 manual · 4 hybrid |
| AJAX Testing | 1 | WSTG · ASVS · CWE | Manual |
| Denial of Service Testing | 8 | WSTG · ASVS · CWE | Manual |
| Web Services Testing | 7 | WSTG · ASVS · CWE | 3 manual · 4 hybrid |
AI and LLM Systems — 26 test cases across 5 pages
| Category | Test cases | Standards | Depth |
|---|---|---|---|
| Prompt Injection | 6 | OWASP LLM Top 10 · CWE | 4 manual · 2 hybrid |
| Retrieval, Context and Data Poisoning | 6 | OWASP LLM Top 10 · CWE | 5 manual · 1 hybrid |
| Tool Use, Function Calling and Agency | 5 | OWASP LLM Top 10 · CWE | 4 manual · 1 hybrid |
| Output Handling and Downstream Trust | 5 | OWASP LLM Top 10 · CWE | 4 manual · 1 hybrid |
| AI Platform, Model Supply and Consumption | 4 | OWASP LLM Top 10 · CWE | 2 manual · 2 hybrid |
Android, iOS and Mobile — 106 test cases across 17 pages
| Category | Test cases | Standards | Depth |
|---|---|---|---|
| Information Gathering (Android) | 4 | ASVS · MASVS · CWE | 1 manual · 3 hybrid |
| Application Local Storage Flaws (Android) | 6 | MASVS · CWE | 5 manual · 1 hybrid |
| IPC Security (Android) | 10 | MASVS · CWE | 8 manual · 2 hybrid |
| Execution of Untrusted Code (Android) | 13 | MASVS · CWE | Manual |
| Authentication Flaws (Android) | 5 | MASVS · CWE | Manual |
| Android Sandbox Security | 3 | MASVS · CWE | 2 manual · 1 hybrid |
| Information Gathering (iOS) | 3 | ASVS · MASVS · CWE | 1 manual · 2 hybrid |
| Application Local Storage Flaws (iOS) | 7 | MASVS · CWE | 6 manual · 1 hybrid |
| IPC Security (iOS) | 8 | MASVS · CWE | 6 manual · 2 hybrid |
| Execution of Untrusted Code (iOS) | 11 | MASVS · CWE | Manual |
| Authentication Flaws (iOS) | 5 | MASVS · CWE | Manual |
| Application Sandbox Security (iOS) | 3 | MASVS · CWE | 2 manual · 1 hybrid |
| Application Keychain Security | 3 | MASVS · CWE | Manual |
| Privacy Breaches | 6 | MASVS · CWE | Manual |
| UI Security | 4 | MASVS · CWE | Manual |
| Business Logic Testing (Mobile) | 3 | MASVS · CWE | Manual |
| Transport Layer Security | 12 | ASVS · MASVS · CWE | 4 manual · 8 hybrid |
IoT and Embedded Devices — 37 test cases across 7 pages
| Category | Test cases | Standards | Depth |
|---|---|---|---|
| Firmware Extraction and Reversing | 7 | CWE | 6 manual · 1 hybrid |
| Device Application Vulnerabilities | 3 | ASVS · CWE | 2 manual · 1 hybrid |
| Device Identity and Access | 10 | ASVS · CWE | 7 manual · 3 hybrid |
| Exposed Debugging Interfaces | 5 | CWE | 4 manual · 1 hybrid |
| Side Channel Attacks | 2 | CWE | 1 manual · 1 hybrid |
| Denial of Service | 3 | CWE | Manual |
| Network Traffic | 7 | ASVS · CWE | 5 manual · 2 hybrid |
Depth of testing
Every test case states whether the work is manual, automated or a mixture. Stating this honestly is the point: claiming manual craft for a check a scanner performs would devalue the claim in the cases where it is true.
- Manual — 195 cases. The test requires a judgement a tool cannot make: which role should reach which function, who owns an object, what the business rules are, or what a device does when its firmware is replaced.
- Hybrid — 77 cases. A tool does the sweep and a person does the part the sweep cannot reach — filter evasion, second-order cases, and deciding whether a result matters.
- Automated — 4 cases. A tool performs the test reliably and the contribution is ensuring it is pointed at everything in scope.
Surface, and what is out of scope
Covered: web applications and their APIs; Android and iOS applications, including the device-side storage, IPC and transport surface; IoT and embedded devices, including firmware, hardware debug interfaces and the protocols they speak; and applications built on a language model, including the retrieval pipeline, the tools the model can call and what is done with what it returns.
Not covered here: physical intrusion; social engineering of named individuals; and denial-of-service testing against production systems, which is run only against an environment agreed for it in advance. Several cases in this catalogue are destructive by nature and are marked as requiring a device or environment designated for them.
Not a certification. A test case mapped to an ASVS or MASVS requirement demonstrates whether the application satisfies that requirement in practice. It is not an accredited certification against the standard, and this page does not claim one.
The full catalogue is at Attacks & Tests.