penetration : Permission

DAST : tst web application souce code

internal pen : test pen simulate the threat from inside / rouge emp

treat modeling : identifying

supplier risk : discuss risk with suppler

IAST : adv sast dast eliminate disadv

black box pen : no inside knowledge id system tested

all access : white

DAST outside sast inside