Guide

Where Automated Scanners Need Manual Testing

Seven areas where application context matters: authentication, authorisation, payment logic and cross-service workflows.

Automated tools are useful for repeatable checks and known patterns. Their coverage depends on configuration, authentication, available context and the assets they can reach. A tool result alone does not establish the security of an entire application.

We do not publish a scanner detection percentage: our client finding totals are not a controlled comparison of automated and manual methods.

1. Business rules

A request can be syntactically valid and still violate a business rule. Review who may issue refunds, change withdrawal destinations or approve settlements, and the conditions required for each transition.

2. Authentication transitions

Check the complete lifecycle: enrolment, login, recovery, session renewal and revocation. A secure login endpoint does not prove that account recovery and privileged actions enforce the same controls.

3. Concurrent transactions

Test transaction invariants with controlled concurrency and authorised test accounts. A retry should not create a second settlement or allow spending beyond the available balance.

4. Object and tenant boundaries

Compare access across users, roles and tenants. Include exports, files, nested API objects and administrative paths; a single authorised endpoint does not validate every access path.

5. Combined weaknesses

Assess how weaknesses interact across trust boundaries. Document prerequisites and demonstrate the resulting impact without inferring a successful chain from unrelated findings.

6. Real-time channels

Review WebSocket authentication, subscription permissions and session expiry. An authorised connection should not give access to another customer’s events.

7. Deployment context

Use the agreed asset inventory to examine exposed services, callback destinations and configuration. Coverage limitations belong in the report alongside findings.

What to ask a testing provider

Ask which roles, workflows and interfaces will be tested; what evidence will be delivered; which assumptions require your team’s input; and how fixes will be verified. Use automation for continuous checks and manual review where application context is necessary.

Read the authentication case study or inspect the report format.