What is security testing?

Question

IT Interview Practice · Accepted Answer

**Security testing** evaluates software for **vulnerabilities and security weaknesses** — verifying it protects data and resists attacks. It includes various techniques (SAST, DAST, penetration testing, dependency scanning) and is essential as security flaws can have severe consequences.

## What security testing checks

```text
Security testing finds VULNERABILITIES and verifies defenses:
  → common flaws: injection (SQL, etc.), XSS, broken authentication/authorization,
    sensitive data exposure, misconfigurations, vulnerable dependencies (OWASP Top 10)
  → does the app properly authenticate, authorize, validate input, encrypt data, etc.?
→ ensures the software resists attacks and protects data/users.
```

## Types/techniques of security testing

```text
SAST (Static) → analyze SOURCE CODE for vulnerabilities (without running it) — in CI
DAST (Dynamic) → test the RUNNING app for vulnerabilities (attack it from outside)
DEPENDENCY scanning (SCA) → find known vulnerabilities in libraries (Snyk, Dependabot)
PENETRATION testing → ethical hackers actively try to BREAK IN (find real exploitable flaws)
SECRET scanning → detect committed secrets; CONFIGURATION/IaC scanning
```

## Integrating security (shift left)

```text
✓ SHIFT SECURITY LEFT → test for vulnerabilities EARLY (in development/CI), not just at the end
✓ Automate SAST/dependency scanning in CI/CD (catch issues per change)
✓ Regular pen testing for critical apps; threat modeling; security code review
✓ WHY: security breaches are SEVERE (data leaks, financial/legal/reputation damage) →
  finding vulnerabilities before attackers do is critical
```

## Why it matters

Understanding security testing is valuable senior-level knowledge because **security vulnerabilities can have severe consequences** (breaches, data leaks, financial and reputational damage), so testing for them is essential, making this important knowledge.

Security testing evaluates software for **vulnerabilities** (injection, XSS, broken authentication/authorization, data exposure, vulnerable dependencies — the OWASP Top 10 kinds of flaws) and verifies its defenses — ensuring the software resists attacks and protects data and users, a critical quality given how damaging security failures are.

Understanding the **types and techniques** is key: **SAST** (static analysis of source code for vulnerabilities, runnable in CI), **DAST** (dynamic testing of the running app by attacking it), **dependency scanning/SCA** (finding known vulnerabilities in libraries — increasingly important given supply-chain risks), **penetration testing** (ethical hackers actively trying to break in to find real exploitable flaws), and secret/configuration scanning — each addressing different aspects of security.

Understanding **integrating security (shift left)** — testing for vulnerabilities early in development and CI (not just at the end), automating SAST and dependency scanning in CI/CD, doing regular pen testing for critical apps, and the rationale (finding vulnerabilities before attackers do, since breaches are severe) — reflects the modern approach of building security testing into the development process.

Security is an essential, often-underemphasized quality dimension, and understanding how to test for vulnerabilities is increasingly important as security threats grow.

Since security vulnerabilities have severe consequences and security testing (SAST, DAST, dependency scanning, pen testing, integrated early via shift-left) is how vulnerabilities are found before attackers exploit them, and since understanding the techniques and approach is important for building secure software, understanding security testing is valuable senior-level knowledge — important for addressing the critical security dimension of quality, finding vulnerabilities before they're exploited, and reflecting the security awareness expected for senior roles in an environment of significant and growing security threats.

What security testing checks

Types/techniques of security testing

Integrating security (shift left)

Why it matters

Related questions