Vulnerability Scanning & Security Testing
Vulnerability scanning is the automated and manual testing of software code, third-party libraries, container images, and running applications to discover security weaknesses before attackers can exploit them. Effective programs combine static, dynamic, and dependency scanning with scheduled penetration tests.
1. The Security Testing Pyramid: Layered Verification
No single security tool can detect all vulnerabilities. Static tools (SAST) inspect source code syntax, composition analyzers (SCA) check third-party libraries, and dynamic scanners (DAST) probe live running APIs:
White-Box Testing (SAST / SCA)
Inspects source code and package lockfiles directly during compilation. Fast, 100% code coverage, but cannot detect runtime environment misconfigurations.
Black-Box Testing (DAST / Pen-Testing)
Probes live HTTP endpoints without access to source code. Detects actual runtime authentication flaws, CORS misconfigurations, and real-world exploit paths.
Interactive & Fuzz Testing (IAST / Fuzzing)
Instruments running servers while injecting randomized boundary inputs to discover memory panics, buffer overflows, and complex race conditions.
Security Testing Methodologies & Execution Frequency
Security testing tools operate across different layers of the application stack. Select any testing type to inspect its plain-language definition, execution stage, frequency, and deployment block threshold:
| Testing Type | Pipeline Stage Placement | Recommended Frequency | Pipeline Gating Threshold |
|---|---|---|---|
SAST Static Application Security Testing | Pre-Commit Local Hook & CI Pull Request Gate | Every Git commit & Pull Request (Continuous) | Block PR merge on ANY Critical or High severity findings. |
SCA Software Composition Analysis | CI Build & Dependency Resolution Stage | Every CI Build & Weekly Automated Cron | Block build on CVSS score >= 7.0 with an available patch version. |
DAST Dynamic Application Security Testing | Post-Deploy Staging Validation Environment | Weekly Staging Run & Pre-Release Tag | P1 defect ticket created immediately; release halted on Criticals. |
IAST Interactive Application Security Testing | Automated Integration & E2E Test Suite Runs | Continuous during E2E / QA test runs | High findings flagged in QA report before staging sign-off. |
Pen Testing Manual Penetration Testing | Pre-Production Staging & Major Release Milestones | Quarterly or annually, plus after major architectural changes | All Critical & High findings must have verified remediations. |
Fuzzing Fuzz Testing (Automated Mutation Testing) | Dedicated Nightly CI Regression Runners | Nightly automated runs and pre-release stress cycles | Fix all unhandled panic or denial-of-service crash triggers. |
Static Application Security Testing (SAST)
Pre-Commit Local Hook & CI Pull Request GatePlain-Language Definition: White-box source code scanner that inspects application code for syntax vulnerabilities (SQL injection, XSS, insecure cryptography) without executing the program.
Semgrep, SonarQube, CodeQL, Checkmarx3. Automated Pipeline Severity Gating Thresholds
Security scans are only effective if failure rules are strictly enforced by CI/CD runners:
- Critical Severity (CVSS 9.0–10.0): Immediate pipeline block. Releases halted; hotfix SLA <24 hours.
- High Severity (CVSS 7.0–8.9): Pull request blocked unless an official compensating control exception is approved. Remediation SLA <7 days.
- Medium Severity (CVSS 4.0–6.9): PR merged with warning ticket generated in engineering backlog. Remediation SLA <30 days.
4. CI/CD Pipeline Automation Alignment
View DevSecOps Scanning PipelineFor detailed CI/CD runner workflows, GitHub Actions YAML configurations, and Cosign container signing steps, refer to the DevSecOps sub-topic in the CI/CD & DevOps category.
Community Discussion & Feedback
Attributed peer feedback and official Netspective architecture notes.