# Security Testing Standards · ST

## Standard Metadata

- Area: Security
- Owner: Security group
- Last reviewed: 2026-09-09
- Next review due from: 2026-12-01
- Enforcement: Code review
- Status: Active

## Overview

This document provides guidance on best practices for security testing to ensure systems are secure and vulnerabilities are identified and mitigated effectively.

## Security scans must be run on a regular basis · ST-01 · **MUST** · **TEST**

Security scans must be run on a regular basis (e.g. weekly) to identify vulnerabilities in the system. These scans should include:

- **Baseline Scans**: Scans performed without authentication to identify publicly exposed vulnerabilities.
- **Authenticated Scans**: Scans performed with valid credentials to identify vulnerabilities within the authenticated areas of the system.

## A vulnerability management process must be documented and followed · ST-02 · **MUST** · **TEST**

A vulnerability management process must be documented and followed to ensure vulnerabilities are tracked, prioritized, and resolved. This process should include:

- **Identification**: Regular scans and manual reviews to identify vulnerabilities, should include how to raise bugs.
- **Assessment**: Prioritization of vulnerabilities based on severity and impact.
- **Remediation**: Timely resolution of identified vulnerabilities.

## Authorization tests must be included in automated tests · ST-03 · **MUST** · **TEST**

Authorization tests must be included in automated tests to ensure that users can only access resources they are authorized to access. Examples of such tests include:

- Verifying that users with specific roles cannot access restricted endpoints or web pages.
- Ensuring that user without an admin role cannot perform administrative actions.
- Confirming that sensitive data is not exposed to users without proper permissions.

## Applications that use large language models must conduct LLM red teaming · ST-04 · **MUST** · **TEST**

Audacia's preferred approach to LLM red teaming is captured as a [sensible default](https://dev.azure.com/audacia/Audacia/_wiki/wikis/Audacia.wiki/16232/LLM-Testing).