Home / Knowledge hub / Exploratory security testing
Knowledge hub
Exploratory security testing
Unscripted testing where the tester follows hunches about how the app breaks.
What it means
Exploratory security testing is testing without a fixed script. The tester learns the application as they go, forms a guess about where it might break, tries it, and lets the result decide the next move. Notes are kept along the way, so the path can be repeated later.
The contrast is with a checklist or a scan, which asks the same questions of any app. An exploratory tester asks questions only this app raises: what happens if I skip step two of checkout, or reuse this link after my plan changes. It rewards curiosity and a feel for how your business works.
Why it matters
Many serious flaws do not look like flaws in isolation. Each page works, each endpoint answers correctly, and the problem only appears when steps are combined or taken in an odd order. A scripted test never asks that question, because nobody wrote it down. These are the business logic flaws that automated checks tend to miss.
It also finds the cases where your own assumptions were wrong. The team believed a step could only be reached from the previous screen. A tester who simply tried the address directly shows otherwise, and the evidence is a working request rather than an opinion.
How it shows up
In a penetration test it fills the gaps between known checks. The tester maps the app, notices something odd (a hidden field, an ID in a URL, an error that says too much) and follows it. Good work leaves a trail: what was tried, what happened, and the exact request that proved it.
The weakness is repeatability. If nothing is written down, you cannot tell what was covered, and you cannot re-run it after the fix. Ask for notes and for each finding to include reproduction steps. Then keep the useful cases as permanent tests, so the hunch becomes a check.
Questions people ask
Exploratory security testing, answered
Is exploratory testing the same as ad hoc testing?
Not quite. Ad hoc testing is unplanned poking with no record. Exploratory testing is still unscripted, but it has a goal, a time box and notes about what was tried.
The discipline is what lets someone else judge what was covered.
Can a scanner do exploratory testing?
A scanner follows rules it was given in advance. It can try many variations quickly, but it does not wonder why a response looks odd and change tack.
Tools that reason about the running app and its code can get closer, but the test is the same: does the finding come with proof?
How do you measure exploratory testing?
Not by count of test cases. Look at the areas the tester says they covered, the time spent, the findings and the notes behind them.
A short written charter at the start, such as 'the refund flow and everything around it', makes the result easier to judge.
Does exploratory testing replace scripted checks?
No. Scripted checks are good at repeating known questions every build. Exploratory work is good at finding the questions nobody has asked yet.
Most teams need both, and move a discovery into the scripted set once it is understood.
Who should do exploratory security testing?
Someone who knows how attackers think and who has enough access to see how the app really behaves. Developers who built the code are often too close to it.
An independent tester, or a tool working with the code in view, brings a different set of guesses.
Sources
Where this comes from
Related
Terms that sit next to this one
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Manual penetration testing
Testing led by a person's judgement, not just by running an automated scanner.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Reproduction steps
The exact steps another person can follow to see a vulnerability for themselves.
Security test coverage
How much of your application a security test actually reached.
What did the hunch turn up?
We check business-logic flaws and cross-account access, and each finding comes with the request and response that proved it. If we did not break it, we do not report it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.