Home / Knowledge hub / OSSTMM
Knowledge hub
OSSTMM
A methodology for measuring operational security through repeatable tests.
What it means
OSSTMM is the Open Source Security Testing Methodology Manual, published by ISECOM, a non-profit research institute. It describes how to test and measure operational security, and focuses on facts that can be verified rather than opinions. It is free to read and has been updated several times.
Its approach covers several channels: human, physical, wireless, telecommunications and data networks. Results are expressed as measurable values so that two tests can be compared, instead of a narrative that depends on who wrote it. That is the reason it is cited where evidence and repeatability matter.
Why it matters
Security claims are often vague. OSSTMM tries to make them checkable by asking what is exposed, what controls exist and how well they work, and by recording the answers consistently. This suits organisations that want repeatable results rather than a one-off opinion. A measurable result is also easier to improve on the next round.
It is not specific to web applications. For a buyer it is a reason to ask providers how they measure and record results, and whether another team could repeat the test. Compare its focus with the process-oriented PTES. Any provider can describe its method, but few can show that two runs would give the same answer.
How it shows up
You meet OSSTMM in provider proposals, in training and in methodology sections of formal reports. It is broader than most web application work, covering people and physical access as well as networks. It is one of several methods a provider may draw on.
Mistakes: claiming compliance with a methodology without explaining what was tested, and expecting it to tell you how to test an application's business logic. For web apps and APIs it is usually used alongside the OWASP testing guide. Agree scope and what the test measures up front.
Questions people ask
OSSTMM, answered
What does OSSTMM stand for?
Open Source Security Testing Methodology Manual. It is published by ISECOM and has gone through several versions, with version 3 widely referenced.
It is free to read. Check the current version on the publisher's site.
Is OSSTMM a certification?
The methodology itself is a manual. ISECOM also offers professional certifications based on it.
Following the manual does not on its own certify a company or product.
How is it different from PTES?
PTES outlines the phases of a penetration test engagement. OSSTMM focuses on measuring operational security with repeatable metrics.
They can be used together. Use both for different purposes.
Does OSSTMM cover web application testing?
Only broadly. It deals with security at the level of channels and controls, not specific web flaws such as injection or broken access checks.
Use OWASP guidance for application detail.
Should I ask my provider about it?
You can ask which methods they follow and how results are recorded. The answer tells you whether the work is structured.
What matters is the evidence they give, not the label.
Sources
Where this comes from
Related
Terms that sit next to this one
PTES
A standard outline of the phases of a penetration test.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Penetration test scope
The written list of what a pentest may and may not touch.
Web application penetration testing
A pentest focused on a web app, its APIs and the logic behind them.
Network penetration testing
Testing the servers, services and network paths around your applications.
Can the result be repeated?
Repeatable results need evidence, not opinion. Every finding we report is one we exploited, with the request, response and proof. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.