Security testing, team exercises and threat modelling

Use different tests for different questions

A vulnerability scan looks for possible weaknesses; results need interpretation and may include false positives or miss issues. Penetration testing attempts to examine exploitable paths within an agreed scope; it is not proof that no other weakness exists. Static application security testing examines code or related artifacts without executing the target application; dynamic testing examines a running application. Their visibility and limitations differ, so one result does not replace all other assurance.

Understand team roles

Blue work protects, detects and responds. Red exercises use an adversarial perspective to test agreed objectives. Purple or joint work helps defenders and testers learn together. These are functions and exercise arrangements, not a universal requirement to employ three separate departments. The source is a conceptual example, not permission to test another organization.

Model threats before and during development

Threat modelling asks what is being built, what can go wrong, what responses are appropriate and how the result will be checked. Begin with system purpose, boundaries and dependencies, then connect possible failures to controls and validation. It is a structured reasoning activity, not simply running a scanner or listing every known attack.

Define the rules before any practical test

Rules of engagement should establish authorization, targets, exclusions, contacts, timing, permitted activity, stop conditions, evidence handling and reporting. Physical and social exercises can include controlled phishing, impersonation or entry-control scenarios, but they still require an authorized design. No live scanning, social engineering or physical test is assigned by this guide.

Test outcomes for AI-integrated defences

Editorial application: define the expected behaviour, data boundaries, authorization and success criteria for a test of a system using AI. Review whether it detects relevant activity and whether benign activity triggers inappropriate responses. A successful demonstration in one case does not validate all operating conditions. Keep scope and stop conditions just as clear as for other testing.

Connect the terminology.