Home > Research > Publications & Outputs > The simulated security assessment ecosystem

Electronic data

  • ssa-ecosystem-preprint

    Accepted author manuscript, 1 MB, PDF document

    Available under license: CC BY: Creative Commons Attribution 4.0 International License


Text available via DOI:

View graph of relations

The simulated security assessment ecosystem: Does penetration testing need standardisation?

Research output: Contribution to Journal/MagazineJournal articlepeer-review

<mark>Journal publication date</mark>09/2016
<mark>Journal</mark>Computers and Security
Number of pages21
Pages (from-to)296-316
Publication StatusPublished
Early online date11/08/16
<mark>Original language</mark>English


Simulated security assessments (a collective term used here for penetration testing, vulnerability assessment, and related nomenclature) may need standardisation, but not in the commonly assumed manner of practical assessment methodologies. Instead, this study highlights market failures within the providing industry at the beginning and ending of engagements, which has left clients receiving ambiguous and inconsistent services. It is here, at the prior and subsequent phases of practical assessments, that standardisation may serve the continuing professionalisation of the industry, and provide benefits not only to clients but also to the practitioners involved in the provision of these services. These findings are based on the results of 54 stakeholder interviews with providers of services, clients, and coordinating bodies within the industry. The paper culminates with a framework for future advancement of the ecosystem, which includes three recommendations for standardisation.