Engagements follow recognised frameworks. The mix depends on asset class, threat model and compliance goals. Written rules of engagement are mandatory before any live testing.
Penetration Testing Execution Standard. Structures pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. Used as the default spine for network and host assessments so scope, evidence and retest criteria stay consistent across operators.
Technical Guide to Information Security Testing and Assessment. Anchors planning, discovery, attack and reporting phases for organisations that need audit-friendly language. Useful when stakeholders expect NIST-aligned artefacts or when findings feed into federal or regulated control programmes.
Open Source Security Testing Methodology Manual. Emphasises measurable security metrics across human, physical, wireless, telecommunications and data networks. Applied when engagements need objective coverage scores rather than checklist pass/fail alone, especially for physical and operational channels.
OWASP Top 10 and API Top 10 drive web and API test cases. Testing covers injection, broken auth, misconfiguration and business-logic abuse with evidence suitable for developer remediation. Mobile and cloud reviews borrow OWASP ASVS / MASVS control levels when depth requirements are explicit in the SOW.
Adversary tactics and techniques map findings and red-team activity to a shared vocabulary. Used for reporting, detection gap analysis and aligning offerings to real-world tradecraft. See the interactive map for how SilkSpider services cover ATT&CK tactics.