Cyber Resilience

← ISO 27001 Annex A

A.8.29 Technological

Security testing in development and acceptance

AttributesPreventive C·I·A Identify Application security Information security assurance System and network security Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (11)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CA-2→P CA-8←P CM-3→P RA-5←P SA-11←M →M SA-15←M SA-3←M SA-4←P →M SI-2→P

Why these map — AI rationale (under review)

SA-11mostlyaligns with — Both controls require systematic security testing and evaluation of systems during development and prior to acceptance to confirm that security functions and configurations meet requirements.
SA-4mostlyaligns with — Both controls embed security requirements into the acquisition and development process and mandate verification that delivered products satisfy those requirements before acceptance.
CA-2partialaligns with — Both controls use structured testing and assessment activities to verify that security controls are implemented correctly and operating as intended.
CM-3partialaligns with — Both controls require that changes to systems undergo planned testing and evaluation before being accepted into the operational environment.
SI-2partialaligns with — Both controls emphasize identifying and remediating security defects discovered through testing before systems are placed into production.

Aligned NIST CSF 2.0 outcomes (12)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

GV.SC-05←M ID.IM-02←M →P ID.RA-01←P →M ID.RA-09←M →P PR.AA-01→P PR.PS-01←P →P PR.PS-06←F →M

Why these map — AI rationale (under review)

ID.RA-01mostlyaligns with — Security testing activities such as vulnerability scanning and penetration testing systematically identify and record vulnerabilities in systems under development.
PR.PS-06mostlyaligns with — The ISO control embeds security testing and defect remediation directly into the software development lifecycle, which is the core outcome sought by PR.PS-06.
ID.IM-02partialaligns with — Security testing performed in coordination with development teams and suppliers generates findings that drive security improvements.
ID.RA-09partialaligns with — Pre-acquisition evaluation of supplier products and components against security requirements mirrors the authenticity and integrity assessment required before use.
PR.AA-01partialaligns with — Testing explicitly validates authentication and access-control functions, ensuring identities and credentials behave as intended.
PR.PS-01partialaligns with — Secure-configuration testing verifies that operating systems, firewalls, and other components are hardened before deployment.

Related OWASP ASVS 5.0 requirements (13)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V1.2.4←M →P V11.2.1←M →P V13.4.2←M →P V15.1.1→M V15.2.1←P →M V16.3.4→P V6.2.1→P V6.3.3←M V8.2.1←M

Why these map — AI rationale (under review)

V15.1.1mostlyaligns with — The ISO control's requirement for documented, risk-based remediation timelines for security defects directly supports the ASVS mandate that third-party component vulnerabilities be addressed within defined time frames.
V15.2.1mostlyaligns with — Requiring that only components meeting documented remediation schedules are present in the application mirrors the ISO expectation that security defects identified during testing are remediated before acceptance.
V1.2.4partialaligns with — Testing secure coding practices, including the use of parameterized queries, is one of the explicit security-testing objectives listed in the ISO guidance.
V11.2.1partialaligns with — The ISO requirement to test the correct use of cryptography aligns with the ASVS requirement that validated cryptographic implementations are employed throughout the application.
V13.4.2partialaligns with — Verifying that debug modes are disabled in production is a concrete outcome of the ISO control's secure-configuration testing activities.
V16.3.4partialaligns with — The ISO control's emphasis on testing for security control failures is reflected in the ASVS requirement to log unexpected errors and security-control failures such as backend TLS failures.
V6.2.1partialaligns with — Security testing of authentication functions, such as verifying minimum password length, is explicitly called out as a required element of the ISO control's security-function testing.

Related weaknesses / CWE (776)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-1004→M CWE-1007←P →P CWE-102←P →M CWE-1021→M CWE-1022←P →M CWE-1023←P →M CWE-1024←P →M CWE-1025←P →M CWE-1037←P →M CWE-1038←P →M CWE-1039←P →M CWE-1049←P →M CWE-1050→M CWE-1056→M CWE-1057→M CWE-1066←P →M CWE-1067←P →P CWE-1068→M CWE-1077→M CWE-1083→M CWE-1088←P →M CWE-1091←P →M CWE-11→M CWE-1102→M CWE-1103←P →P CWE-111←P →M CWE-1119→M CWE-112→M CWE-1124→P CWE-113→M CWE-114←P →M CWE-115→M CWE-116→M CWE-1164→P CWE-117→M CWE-1173→M CWE-1174→M CWE-1176←P CWE-118←P →M CWE-1189→M CWE-119←P →M CWE-1190→M CWE-1191→M CWE-12→M CWE-120←P →M CWE-1204→M CWE-121←P →M CWE-122←P →M CWE-1221←P →M CWE-1223←P →M CWE-1224←P →M CWE-123←P →M CWE-1231←P →M CWE-1233→M CWE-1234→M CWE-1236→M CWE-124←P →M CWE-1240←P →M CWE-1241→M CWE-1242←P →M CWE-1244←P →M CWE-1245→M CWE-1246→M CWE-1247←P →P CWE-125←P →M CWE-1253→M CWE-1254←P →M CWE-1255←P →M CWE-1256←P →M CWE-1257→M CWE-1258←P →M CWE-1259→M CWE-126←P →M CWE-1260→M CWE-1262→M CWE-1264→M CWE-1265←P →M CWE-1269←P →M CWE-127←P →M CWE-1270←P →M CWE-1275→M CWE-1278←P →P CWE-1279←P →M CWE-128←P →M CWE-1281←P →M CWE-1283→M CWE-1284→M CWE-1285←P →M CWE-1286→M CWE-1287→M CWE-1288→M CWE-1289←P →M CWE-129→M CWE-1291←P →P CWE-1295←P →M CWE-1298→M CWE-1299→M CWE-130←P →M CWE-1300→P CWE-1303→P CWE-131←P →M CWE-1312→M CWE-1313←P →M CWE-1316←P →M CWE-1319→M CWE-1320←P →M CWE-1321→M CWE-1322→M CWE-1325→M CWE-1332←P →P CWE-1333→M CWE-1335←P →M CWE-1336→M CWE-134←P →M CWE-1341←P →M CWE-1342→P CWE-135←P →M CWE-138→M CWE-1385←P →M CWE-1386←P →M CWE-1389→M CWE-1391←P →M CWE-14→M CWE-140→M CWE-141→M CWE-142←P →M CWE-143→M CWE-144→M CWE-145→M CWE-146→M CWE-147→M CWE-148←P →M CWE-149→M CWE-150→M CWE-153→M CWE-154→M CWE-155→M CWE-156→M CWE-157→M CWE-158→M CWE-159→M CWE-160→M CWE-162→M CWE-164→M CWE-166→M CWE-167←P →M CWE-168→M CWE-170←P →M CWE-172←P →M CWE-173→M CWE-176←P →M CWE-177→M CWE-179→M CWE-180→M CWE-182→M CWE-183←P →M CWE-184→M CWE-185←P →M CWE-186←P →M CWE-187←P →M CWE-188←P →M CWE-190←P →M CWE-191←P →M CWE-192←P →M CWE-193←P →M CWE-194←P →M CWE-195←P →M CWE-196←P →M CWE-197←P →M CWE-198←P →M CWE-20→M CWE-200→M CWE-202←P →P CWE-204←P →M CWE-205←P →M CWE-207→M CWE-209→M CWE-210→M CWE-215←P →M CWE-22←P →M CWE-226→M CWE-228→M CWE-229→M CWE-23→M CWE-230→M CWE-231→M CWE-232←P →M CWE-233→M CWE-234←P →M CWE-235→M CWE-236→M CWE-237←P →M CWE-239→M CWE-24→M CWE-240←P →M CWE-241→M CWE-242→M CWE-248←P →M CWE-25→M CWE-252←P →M CWE-253←P →M CWE-26→M CWE-27→M CWE-273→M CWE-277→M CWE-28←P →M CWE-280→M CWE-284→M CWE-288→M CWE-29→M CWE-290←P →M CWE-296→M CWE-297←P →M CWE-298→M CWE-299→M CWE-30→M CWE-301→M CWE-302←P →M CWE-303←P →M CWE-305→M CWE-31→M CWE-316→M CWE-318→M CWE-32→M CWE-322→M CWE-323→M CWE-325→M CWE-328→M CWE-329→M CWE-330→M CWE-331→M CWE-332→M CWE-333→M CWE-334→M CWE-335→M CWE-336→M CWE-337→M CWE-338→M CWE-339→M CWE-34→M CWE-340→M CWE-341→M CWE-342→M CWE-343→M CWE-345→M CWE-348→M CWE-349→M CWE-35←P →M CWE-351←P →M CWE-354→M CWE-356→M CWE-357←P →M CWE-358←P →M CWE-36←P →M CWE-362←P →M CWE-363→M CWE-364←P →M CWE-366←P →M CWE-368←P →M CWE-369←P →M CWE-37→M CWE-372←P →M CWE-377→M CWE-378→M CWE-38→M CWE-384→M CWE-385→P CWE-39→M CWE-390←P →M CWE-391←P →M CWE-392←P →M CWE-393←P →M CWE-394←P →M CWE-395→M CWE-396←P →M CWE-40←P →M CWE-401←P →M CWE-403→M CWE-407←P →M CWE-409→M CWE-41←P →M CWE-410→P CWE-413→M CWE-414→M CWE-415→M CWE-416←P →M CWE-42←P →M CWE-421←P →M CWE-422→M CWE-424←P →M CWE-425→M CWE-426→M CWE-427→M CWE-428←P →M CWE-43←P →M CWE-430←P →M CWE-431←P →M CWE-433→M CWE-434→M CWE-435←P →M CWE-436←P →M CWE-437←P →M CWE-44→M CWE-440←P →M CWE-444←P →M CWE-446←P →M CWE-447←P →M CWE-448←P →P CWE-449←P →M CWE-450←P →M CWE-451←P →M CWE-453→M CWE-454→M CWE-455←P →M CWE-456←P →M CWE-457→M CWE-46←P →M CWE-460←P →M CWE-462←P →M CWE-463→M CWE-466←P →M CWE-467→M CWE-468→M CWE-469←P →M CWE-470←P →M CWE-471→M CWE-472→M CWE-473→M CWE-474→M CWE-475←P →M CWE-476←P →M CWE-478←P →M CWE-479←P →M CWE-480←P →M CWE-482→M CWE-484→M CWE-488→M CWE-489←P →M CWE-491←P →M CWE-495→M CWE-499←P →M CWE-50←P →M CWE-502→M CWE-507←P →M CWE-511←P →M CWE-514→P CWE-515←P →M CWE-531←P →M CWE-535→M CWE-539←P →M CWE-541→M CWE-544←P →M CWE-548←P →M CWE-550←P →M CWE-551→M CWE-553→M CWE-561→M CWE-562←P →M CWE-564→M CWE-565→M CWE-566→M CWE-567→M CWE-57→M CWE-570→M CWE-571→M CWE-573→M CWE-587→M CWE-588←P →M CWE-59←P →M CWE-590←P →M CWE-591→M CWE-597→M CWE-598→M CWE-599→M CWE-6→M CWE-600←P →M CWE-602→M CWE-603←P →M CWE-606←P →M CWE-61←P →M CWE-610→M CWE-611→M CWE-615→M CWE-616→M CWE-617←P →M CWE-618→M CWE-62→M CWE-621→M CWE-622←P →M CWE-623→M CWE-624←P →M CWE-625→M CWE-626←P →M CWE-627→M CWE-628→M CWE-639→M CWE-64→M CWE-641→M CWE-643→M CWE-644→M CWE-646←P →M CWE-647→M CWE-648→M CWE-649←P →M CWE-65←P →M CWE-650←P →M CWE-652→M CWE-657←P →M CWE-66←P →M CWE-662→M CWE-663→M CWE-665→M CWE-667←P →M CWE-67→M CWE-670←P →M CWE-672→M CWE-674→M CWE-675←P →M CWE-676→M CWE-680←P →M CWE-681←P →M CWE-682←P →M CWE-683←P →M CWE-684←P →M CWE-686←P →M CWE-687←P →M CWE-688→M CWE-690←P →M CWE-691→M CWE-692→M CWE-694→M CWE-695→M CWE-696←P →M CWE-697←P →M CWE-698←P →M CWE-704←P →M CWE-705→M CWE-706←P →M CWE-707→M CWE-710→M CWE-73→M CWE-733→M CWE-74→M CWE-749←P →M CWE-75→M CWE-754←P →M CWE-755←P →M CWE-756←P →M CWE-757→M CWE-758→M CWE-759→M CWE-76→M CWE-760→M CWE-761→M CWE-762←P →M CWE-763←P →M CWE-764←P →M CWE-765←P →M CWE-767→M CWE-768←P →M CWE-77→M CWE-771←P →M CWE-774←P →M CWE-775→M CWE-776→M CWE-777→M CWE-78→M CWE-780→M CWE-782→M CWE-783→M CWE-784→M CWE-786←P →M CWE-787←P →M CWE-788←P →M CWE-789←P →M CWE-79→M CWE-790→M CWE-791→M CWE-792→M CWE-794→M CWE-80→M CWE-804←P →M CWE-805←P →M CWE-807←P →M CWE-81→M CWE-82←P →M CWE-820←P →M CWE-821←P →M CWE-822←P →M CWE-823←P →M CWE-824←P →M CWE-825→M CWE-826←P →M CWE-827←P →M CWE-828→M CWE-83→M CWE-830→M CWE-832→M CWE-833←P →M CWE-834←P →M CWE-835→M CWE-838←P →M CWE-839←P →M CWE-84→M CWE-841→M CWE-843←P →M CWE-85←P →M CWE-86→M CWE-87→M CWE-88→M CWE-89→M CWE-90→M CWE-908←P →M CWE-909→M CWE-91→M CWE-910←P →M CWE-911←P →M CWE-912←P →M CWE-913→M CWE-914←P →M CWE-915→M CWE-917→M CWE-925→M CWE-926→M CWE-927→M CWE-93→M CWE-939→M CWE-941→M CWE-942←P →M CWE-943→M CWE-95→M CWE-96→M CWE-97→M CWE-98→M CWE-99→M

Why these map — AI rationale (under review)

CWE-1004mostlyfinds — Security testing can detect missing HttpOnly flags but does not prevent the weakness.
CWE-102mostlyfinds — Security testing in development can detect duplicate validation forms before release.
CWE-1021mostlyfinds — Security testing can detect missing frame protections, but does not itself implement the control.
CWE-1022mostlyfinds — Security testing can detect missing protections on external links through automated or manual checks.
CWE-1023mostlyfinds — Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.
CWE-1024mostlyfinds — Security testing in development can detect type-mismatch defects through static analysis and unit tests.
CWE-1025mostlyfinds — Security testing can detect incorrect comparison results during development and acceptance.
CWE-1037mostlyfinds — Security testing in development can detect when optimizations have removed intended protections.
CWE-1038mostlyfinds — Security testing in development and acceptance can detect unintended side-effects introduced by automated optimizations.
CWE-1039mostlyfinds — Security testing in development can explicitly cover adversarial input testing for recognition mechanisms.
CWE-1049mostlyfinds — Security testing in development can detect performance issues caused by excessive query operations.
CWE-1050mostlyfinds — Security testing can discover the defect but does not remove it from production code.
CWE-1056mostlyfinds — Security testing can detect misuse of variadic functions but does not prevent their introduction.
CWE-1057mostlyfinds — Security testing can detect unauthorized data-access paths bypassing the central manager.
CWE-1066mostlyfinds — Security testing can detect missing serialization methods before production deployment.
CWE-1068mostlyfinds — Security testing can detect deviations, yet does not prevent the inconsistency from occurring.
CWE-1077mostlyfinds — Security testing can detect floating-point comparison defects but does not prevent them by itself.
CWE-1083mostlyfinds — Security testing can detect unauthorized direct access paths, but does not itself prevent their introduction.
CWE-1088mostlyfinds — Security testing can detect missing timeouts, providing partial coverage of both the weakness and the control.
CWE-1091mostlyfinds — Security testing can detect missing destructor calls through static analysis or resource-leak testing.
CWE-11mostlyfinds — Security testing in development and acceptance can detect debug binaries but does not prevent their creation or deployment.
CWE-1102mostlyfinds — Security testing can detect platform-specific representation issues but does not itself prevent their introduction.
CWE-111mostlyfinds — Security testing can detect unsafe JNI usage through static analysis and fuzzing of native boundaries.
CWE-1119mostlyfinds — Security testing can detect overly complex or unstructured code, yet the control focuses on testing rather than coding rules.
CWE-112mostlyfinds — Security testing in development can detect missing XML validation but does not itself implement the control.
CWE-113mostlyfinds — Security testing in development and acceptance can detect CRLF injection flaws before deployment.
CWE-114mostlyfinds — Security testing can detect unsafe process or library loading but does not prevent it by itself.
CWE-115mostlyfinds — Security testing can detect input misinterpretation flaws but does not itself implement the preventive controls.
CWE-116mostlyfinds — Security testing can detect missing or incorrect encoding but does not itself implement the control.
CWE-117mostlyfinds — Security testing can detect log injection flaws but does not prevent them at the source.
CWE-1173mostlyfinds — Security testing can detect missing validation but does not enforce framework adoption.
CWE-1174mostlyfinds — Security testing in development and acceptance will detect missing model validation.
CWE-118mostlyfinds — Security testing can detect range errors through fuzzing and boundary-value analysis.
CWE-1189mostlyfinds — Security testing can detect SoC isolation issues but does not prevent the weakness from existing in the design.
CWE-119mostlyfinds — Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.
CWE-1190mostlyfinds — Security testing can detect DMA enablement before security configuration is complete.
CWE-1191mostlyfinds — Security testing can discover improper debug access but does not itself implement the control.
CWE-12mostlyfinds — Security testing can detect missing custom error pages during acceptance testing.
CWE-120mostlyfinds — Security testing in development and acceptance can detect buffer overflows through fuzzing and static analysis, though it does not prevent them at the source.
CWE-1204mostlyfinds — Security testing in development can detect use of static or predictable IVs before release.
CWE-121mostlyfinds — Security testing (fuzzing, static analysis) detects stack overflows before release.
CWE-122mostlyfinds — Security testing in development and acceptance can detect heap overflows before release.
CWE-1221mostlyfinds — Security testing in development can detect incorrect register defaults before deployment.
CWE-1223mostlyfinds — Security testing in development can include hardware simulation and formal verification to catch write-once register race conditions.
CWE-1224mostlyfinds — Security testing in development can detect reprogrammable sticky bits before tape-out.
CWE-123mostlyfinds — Security testing in development and acceptance can detect write-what-where conditions before deployment.
CWE-1231mostlyfinds — Security testing can detect lock-bit modification flaws, but does not inherently prevent the weakness in production hardware.
CWE-1233mostlyfinds — Security testing can detect missing lock-bit protection during hardware/firmware validation.
CWE-1234mostlyfinds — Security testing may detect debug-mode bypasses but does not prevent the underlying hardware weakness.
CWE-1236mostlyfinds — Security testing in development can detect formula injection but does not itself implement the mitigation.
CWE-124mostlyfinds — Security testing in development catches buffer-underflow defects before release.
CWE-1240mostlyfinds — Security testing can detect use of weak or non-compliant cryptographic primitives before deployment.
CWE-1241mostlyfinds — Security testing can detect predictable RNG behavior before deployment.
CWE-1242mostlyfinds — Security testing in development and acceptance can uncover undocumented functionality before release.
CWE-1244mostlyfinds — Security testing can detect unsafe debug states, but testing alone does not prevent the design flaw.
CWE-1245mostlyfinds — Security testing in development can discover undefined FSM states before deployment.
CWE-1246mostlyfinds — Security testing can detect missing wear-leveling but does not itself implement the mitigation.
CWE-125mostlyfinds — Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.
CWE-1253mostlyfinds — Security testing can detect incorrect fuse selection before release but does not prevent the weakness in production hardware.
CWE-1254mostlyfinds — Security testing can detect timing side-channels arising from stepwise comparison logic.
CWE-1255mostlyfinds — Security testing in development can include side-channel analysis to detect and remediate power-leakage vulnerabilities.
CWE-1256mostlyfinds — Security testing in development can detect and remediate improper hardware interface exposure before deployment.
CWE-1257mostlyfinds — Security testing in development can detect inconsistent access controls on aliased memory.
CWE-1258mostlyfinds — Security testing in development can detect uncleared debug information before release.
CWE-1259mostlyfinds — Security testing can detect improper token assignment but does not prevent it at design time.
CWE-126mostlyfinds — Security testing in development can detect buffer over-reads before release.
CWE-1260mostlyfinds — Security testing in development and acceptance can detect overlap issues but does not itself prevent them.
CWE-1262mostlyfinds — Security testing can discover improper register access but does not prevent it at runtime.
CWE-1264mostlyfinds — Security testing in development can detect de-synchronization flaws between control and data paths before deployment.
CWE-1265mostlyfinds — Security testing in development can detect reentrancy vulnerabilities through stress, concurrency, and fuzz testing.
CWE-1269mostlyfinds — Security testing and acceptance criteria can detect and block deployment of pre-production builds.
CWE-127mostlyfinds — Security testing can detect buffer under-reads before release.
CWE-1270mostlyfinds — Security testing in development can detect incorrect token generation before deployment.
CWE-1275mostlyfinds — Security testing can detect missing SameSite attributes but does not prevent the weakness.
CWE-1279mostlyfinds — Security testing in development can detect cases where crypto runs before inputs are valid.
CWE-128mostlyfinds — Security testing can detect wrap-around errors through boundary and fuzz testing.
CWE-1281mostlyfinds — Security testing in development can detect and block instruction sequences that lead to processor lock-ups before deployment.
CWE-1283mostlyfinds — Security testing can detect weaknesses that permit mutable attestation data.
CWE-1284mostlyfinds — Security testing in development can detect missing quantity validation but does not itself implement the control.
CWE-1285mostlyfinds — Security testing can detect missing or incorrect index validation during development and acceptance.
CWE-1286mostlyfinds — Security testing in development catches missing or incorrect syntax validation.
CWE-1287mostlyfinds — Security testing can detect type-validation flaws but does not prevent them during development.
CWE-1288mostlyfinds — Security testing can detect consistency flaws but does not prevent them at design time.
CWE-1289mostlyfinds — Security testing can detect unsafe equivalence flaws but does not prevent them at design time.
CWE-129mostlyfinds — Security testing in development can detect out-of-bounds array access but does not prevent the weakness by itself.
CWE-1295mostlyfinds — Security testing can detect excessive debug information, but does not guarantee its prevention in production.
CWE-1298mostlyfinds — Security testing in development can include hardware timing and race-condition verification.
CWE-1299mostlyfinds — Security testing can discover alternate-path weaknesses but does not inherently prevent them.
CWE-130mostlyfinds — Security testing in development can detect length-inconsistency vulnerabilities before deployment.
CWE-131mostlyfinds — Security testing can detect buffer-size errors before release.
CWE-1312mostlyfinds — Security testing can discover mirror-region bypasses, but does not inherently prevent the design omission.
CWE-1313mostlyfinds — Security testing in development and acceptance includes verification that debug interfaces are disabled or protected before release.
CWE-1316mostlyfinds — Security testing in development can detect address-map overlaps but does not guarantee their prevention at design time.
CWE-1319mostlyfinds — Security testing in development can discover EM-FI susceptibility, but does not inherently prevent the weakness in production.
CWE-1320mostlyfinds — Security testing can verify that alerts and signals cannot be disabled by untrusted agents.
CWE-1321mostlyfinds — Security testing in development catches prototype-pollution flaws before release.
CWE-1322mostlyfinds — Security testing can detect blocking behavior but does not prevent the weakness by itself.
CWE-1325mostlyfinds — Security testing can detect unbounded allocation patterns, but removing the weakness does not fulfill testing obligations.
CWE-1333mostlyfinds — Security testing can detect and reject regex patterns with exponential worst-case complexity.
CWE-1335mostlyfinds — Security testing in development can detect shift-related defects before release.
CWE-1336mostlyfinds — Security testing can detect template-injection flaws but does not itself implement neutralization controls.
CWE-134mostlyfinds — Security testing in development can detect format-string vulnerabilities before release.
CWE-1341mostlyfinds — Security testing in development can detect double-release defects before release.
CWE-135mostlyfinds — Security testing in development and acceptance can detect incorrect multi-byte string length calculations through targeted test cases.
CWE-138mostlyfinds — Security testing can detect instances of CWE-138 but does not itself implement the neutralization controls.
CWE-1385mostlyfinds — Security testing can detect missing origin validation in WebSocket implementations.
CWE-1386mostlyfinds — Security testing can detect junction/mount-point weaknesses before release.
CWE-1389mostlyfinds — Security testing can detect radix-related parsing flaws but does not prevent them by itself.
CWE-1391mostlyfinds — Security testing can discover weak credentials, but does not guarantee they are prevented by design.
CWE-14mostlyfinds — Security testing can detect residual sensitive data left by dead-store removal, but does not prevent the weakness itself.
CWE-140mostlyfinds — Security testing in development and acceptance can detect delimiter-related weaknesses before deployment.
CWE-141mostlyfinds — Security testing can detect delimiter issues but does not itself implement the neutralization.
CWE-142mostlyfinds — Security testing in development and acceptance can detect delimiter-handling defects before release.
CWE-143mostlyfinds — Security testing can detect delimiter issues but does not itself implement the fix.
CWE-144mostlyfinds — Security testing can detect the weakness but does not itself implement the neutralization.
CWE-145mostlyfinds — Security testing in development and acceptance can detect delimiter-neutralization flaws before release.
CWE-146mostlyfinds — Security testing can detect the weakness but does not prevent it by itself.
CWE-147mostlyfinds — Security testing can detect terminator issues but does not itself implement the neutralization control.
CWE-148mostlyfinds — Security testing can detect missing or malformed leaders, providing partial mitigation.
CWE-149mostlyfinds — Security testing can detect quote-injection but does not itself implement the fix.
CWE-150mostlyfinds — Security testing can detect the weakness but does not itself implement neutralization.
CWE-153mostlyfinds — Security testing can detect substitution-character flaws but does not itself implement neutralization.
CWE-154mostlyfinds — Security testing can discover delimiter-injection flaws but does not itself implement the neutralization fix.
CWE-155mostlyfinds — Security testing can detect wildcard issues but does not itself implement neutralization controls.
CWE-156mostlyfinds — Security testing can detect whitespace handling issues but does not prevent them at the source.
CWE-157mostlyfinds — Security testing in development can detect delimiter-handling weaknesses before release.
CWE-158mostlyfinds — Security testing can detect null-byte flaws but does not itself implement the neutralization.
CWE-159mostlyfinds — Security testing can discover the weakness but does not itself implement the preventive control.
CWE-160mostlyfinds — Security testing can detect the weakness but does not itself implement neutralization controls.
CWE-162mostlyfinds — Security testing can detect the weakness but does not itself implement neutralization controls.
CWE-164mostlyfinds — Security testing in development and acceptance can detect the weakness but does not prevent it at design or coding time.
CWE-166mostlyfinds — Security testing can discover missing-element flaws but does not prevent them by itself.
CWE-167mostlyfinds — Security testing in development catches improper handling of unexpected special elements before release.
CWE-168mostlyfinds — Security testing can detect inconsistent-element flaws but does not prevent them by itself.
CWE-170mostlyfinds — Security testing in development can detect missing or incorrect null terminators before release.
CWE-172mostlyfinds — Security testing in development can detect encoding flaws before deployment.
CWE-173mostlyfinds — Security testing can detect encoding-handling defects but does not itself implement the preventive coding controls.
CWE-176mostlyfinds — Security testing can detect Unicode-handling flaws before deployment.
CWE-177mostlyfinds — Security testing in development catches URL-decoding flaws before release, but does not itself define coding rules.
CWE-179mostlyfinds — Security testing can detect early-validation flaws but does not inherently prevent them in design.
CWE-180mostlyfinds — Security testing can detect validation-order defects before deployment.
CWE-182mostlyfinds — Security testing can detect collapse issues but does not prevent them by itself.
CWE-183mostlyfinds — Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.
CWE-184mostlyfinds — Security testing can discover missing input checks, but does not prevent the weakness during development.
CWE-185mostlyfinds — Security testing in development can detect regex-related flaws before release.
CWE-186mostlyfinds — Security testing in development can detect overly restrictive regex through negative-test cases.
CWE-187mostlyfinds — Security testing can detect and prevent partial string comparison flaws before deployment.
CWE-188mostlyfinds — Security testing in development can detect layout-related defects before release.
CWE-190mostlyfinds — Security testing in development can detect integer overflows before release.
CWE-191mostlyfinds — Security testing in development catches integer underflow defects before release.
CWE-192mostlyfinds — Security testing in development can detect integer coercion flaws via fuzzing and static analysis.
CWE-193mostlyfinds — Security testing in development and acceptance can detect off-by-one errors before release.
CWE-194mostlyfinds — Security testing in development can detect unexpected sign-extension behavior through targeted test cases.
CWE-195mostlyfinds — Security testing in development can detect conversion-related defects before release.
CWE-196mostlyfinds — Security testing can detect integer conversion errors through static analysis and fuzzing.
CWE-197mostlyfinds — Security testing can detect truncation bugs through static analysis and fuzzing.
CWE-198mostlyfinds — Security testing can detect byte-order defects before acceptance.
CWE-20mostlyfinds — Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.
CWE-200mostlyfinds — Penetration testing and vulnerability scanning are performed to discover unintended exposure of sensitive data resulting from misconfigurations or coding errors.
CWE-204mostlyfinds — Security testing can detect observable response discrepancies before deployment.
CWE-205mostlyfinds — Security testing can detect and require remediation of observable behavioral differences before release.
CWE-207mostlyfinds — Security testing can detect and eliminate observable behavioral discrepancies before deployment.
CWE-209mostlyfinds — Security testing can detect error messages that leak sensitive information.
CWE-210mostlyfinds — Security testing can detect the weakness but does not prevent it by itself.
CWE-215mostlyfinds — Security testing in development catches debug statements and sensitive data leaks.
CWE-22mostlyfinds — Security testing in development catches path traversal via static/dynamic analysis.
CWE-226mostlyfinds — Security testing can detect failures to sanitize resources before reuse.
CWE-228mostlyfinds — Security testing can detect malformed-input issues but does not itself implement the handling logic.
CWE-229mostlyfinds — Security testing can detect missing-value flaws but does not itself implement the handling logic.
CWE-23mostlyfinds — Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
CWE-230mostlyfinds — Security testing can detect missing-value flaws but does not itself prevent them.
CWE-231mostlyfinds — Security testing can detect extra-value handling issues but does not prevent them by itself.
CWE-232mostlyfinds — Security testing in development can detect missing handling of undefined values before release.
CWE-233mostlyfinds — Security testing can detect missing-parameter issues but does not prevent them at design time.
CWE-234mostlyfinds — Security testing in development and acceptance can detect missing-parameter conditions through negative and boundary testing.
CWE-235mostlyfinds — Security testing can detect extra-parameter handling flaws but does not itself implement the fix.
CWE-236mostlyfinds — Security testing can detect undefined-parameter handling flaws but does not prevent them at the source.
CWE-237mostlyfinds — Security testing in development can detect weaknesses related to improper handling of complex structures.
CWE-239mostlyfinds — Security testing can detect incomplete-element handling but does not itself prevent the weakness in production code.
CWE-24mostlyfinds — Security testing in development catches path-traversal flaws before release.
CWE-240mostlyfinds — Security testing in development and acceptance can detect inconsistent structural handling before release.
CWE-241mostlyfinds — Security testing can detect type-handling flaws but does not itself implement the preventive control.
CWE-242mostlyfinds — Security testing can surface calls to unsafe functions but does not prevent their introduction.
CWE-248mostlyfinds — Security testing can detect uncaught exceptions before production deployment.
CWE-25mostlyfinds — Security testing in development catches path-traversal flaws before production deployment.
CWE-252mostlyfinds — Security testing in development and acceptance can detect missing return-value checks.
CWE-253mostlyfinds — Security testing in development catches missing or incorrect return-value checks.
CWE-26mostlyfinds — Security testing in development catches path traversal via static/dynamic analysis and penetration testing.
CWE-27mostlyfinds — Security testing in development catches path-traversal flaws before release but does not itself implement the control.
CWE-273mostlyfinds — Security testing can detect failed privilege drops, yet the control does not require such checks as part of its core intent.
CWE-277mostlyfinds — Security testing may detect permission issues but does not prevent insecure inheritance by design.
CWE-28mostlyfinds — Security testing in development catches path-traversal flaws before release.
CWE-280mostlyfinds — Security testing can detect missing or incorrect privilege handling.
CWE-284mostlyfinds — Security testing explicitly validates authentication, access restriction, and cryptography functions, directly catching missing or incorrect access control checks before code reaches production.
CWE-288mostlyfinds — Security testing can detect alternate-path bypasses but does not prevent them in production.
CWE-29mostlyfinds — Security testing can discover path-traversal flaws but does not itself prevent them in production code.
CWE-290mostlyfinds — Security testing can detect spoofing vulnerabilities but does not prevent them by itself.
CWE-296mostlyfinds — Security testing can detect missing or incorrect certificate chain validation.
CWE-297mostlyfinds — Security testing can detect missing certificate validation and host-mismatch checks.
CWE-298mostlyfinds — Security testing can detect missing certificate expiration checks but does not constitute the control's full intent.
CWE-299mostlyfinds — Security testing can detect missing or incorrect certificate revocation checks.
CWE-30mostlyfinds — Security testing in development and acceptance will detect path-traversal flaws before release.
CWE-301mostlyfinds — Security testing can detect reflection vulnerabilities, providing partial coverage through verification rather than prevention.
CWE-302mostlyfinds — Security testing can discover and block authentication bypasses that rely on mutable data.
CWE-303mostlyfinds — Security testing can detect flawed authentication implementations but does not prevent them by itself.
CWE-305mostlyfinds — Security testing can detect authentication bypass conditions before deployment.
CWE-31mostlyfinds — Security testing can discover traversal flaws but does not prevent them at the source.
CWE-316mostlyfinds — Security testing can detect cleartext secrets in memory dumps or debug output.
CWE-318mostlyfinds — Security testing may detect the issue but does not prevent it at the source.
CWE-32mostlyfinds — Security testing in development catches path-traversal flaws before release, providing strong but post-coding coverage.
CWE-322mostlyfinds — Security testing can detect missing entity authentication during key exchange.
CWE-323mostlyfinds — Security testing can detect nonce reuse, yet the control addresses many other issues beyond this CWE.
CWE-325mostlyfinds — Security testing can detect incomplete crypto implementations but does not itself enforce correct algorithm steps.
CWE-328mostlyfinds — Security testing can detect weak-hash usage but does not prescribe algorithm choice.
CWE-329mostlyfinds — Security testing in development can detect predictable IV usage before deployment.
CWE-330mostlyfinds — Security testing can detect weak randomness but does not prescribe the control itself.
CWE-331mostlyfinds — Security testing can detect insufficient-entropy defects before release.
CWE-332mostlyfinds — Security testing can detect insufficient entropy in PRNG implementations before deployment.
CWE-333mostlyfinds — Security testing can detect insufficient entropy in TRNG implementations before deployment.
CWE-334mostlyfinds — Security testing can detect insufficient randomness in tokens, session IDs, or keys.
CWE-335mostlyfinds — Security testing can detect weak seeding but does not itself prevent the weakness.
CWE-336mostlyfinds — Security testing can detect predictable PRNG output, but testing alone does not prevent the flaw.
CWE-337mostlyfinds — Security testing can detect and prevent use of weak or predictable PRNG seeds.
CWE-338mostlyfinds — Security testing can detect use of weak random number generators.
CWE-339mostlyfinds — Security testing can detect weak PRNG seeding but does not prevent it by itself.
CWE-34mostlyfinds — Security testing in development and acceptance catches path traversal via dynamic and static analysis.
CWE-340mostlyfinds — Security testing in development can detect predictable identifiers through static/dynamic analysis and fuzzing, reducing residual risk.
CWE-341mostlyfinds — Security testing can detect predictability issues but does not prevent them by itself.
CWE-342mostlyfinds — Security testing can detect predictable random sequences before release.
CWE-343mostlyfinds — Security testing can detect and reject predictable random-value generators.
CWE-345mostlyfinds — Security testing can detect missing or weak data authenticity verification.
CWE-348mostlyfinds — Security testing can detect and prevent acceptance of data from less-trusted sources during development.
CWE-349mostlyfinds — Security testing can detect the weakness but does not itself implement preventive controls.
CWE-35mostlyfinds — Security testing in development can detect path-traversal flaws before release.
CWE-351mostlyfinds — Security testing can detect type confusion vulnerabilities before deployment.
CWE-354mostlyfinds — Security testing can detect missing integrity validation but does not itself implement the control.
CWE-356mostlyfinds — Security testing can verify presence of warnings for unsafe user actions.
CWE-357mostlyfinds — Security testing in development and acceptance validates that dangerous-operation warnings are sufficiently prominent.
CWE-358mostlyfinds — Security testing in development and acceptance validates that required security checks function as specified.
CWE-36mostlyfinds — Security testing in development can detect absolute path traversal via static analysis and fuzzing.
CWE-362mostlyfinds — Security testing can detect race conditions, but does not prevent them at design or coding time.
CWE-363mostlyfinds — Security testing can detect link-following races, but testing alone does not prevent the weakness.
CWE-364mostlyfinds — Security testing can detect signal-handler race conditions before release.
CWE-366mostlyfinds — Security testing can detect race conditions through concurrency and stress testing.
CWE-368mostlyfinds — Security testing can detect race conditions during context switching across privilege boundaries.
CWE-369mostlyfinds — Security testing in development can detect divide-by-zero conditions before release.
CWE-37mostlyfinds — Security testing can discover path-traversal flaws but does not prevent them at runtime.
CWE-372mostlyfinds — Security testing can detect state-machine flaws that manifest as incomplete internal state distinction.
CWE-377mostlyfinds — Security testing can detect insecure temporary files but does not prevent their creation.
CWE-378mostlyfinds — Security testing can detect insecure temporary files but does not prevent their creation.
CWE-38mostlyfinds — Security testing in development can discover path-traversal flaws before deployment.
CWE-384mostlyfinds — Security testing can detect session-fixation issues, yet the weakness absence does not replace comprehensive testing.
CWE-39mostlyfinds — Security testing can discover drive-letter traversal but does not prevent it at runtime.
CWE-390mostlyfinds — Security testing can uncover missing error handling, but does not ensure the weakness is eliminated in production code.
CWE-391mostlyfinds — Security testing can detect missing error handling before deployment.
CWE-392mostlyfinds — Security testing can identify missing error reporting through negative test cases and exception handling checks.
CWE-393mostlyfinds — Security testing in development can detect functions returning wrong status codes.
CWE-394mostlyfinds — Security testing can detect missing checks for unexpected but valid return values.
CWE-395mostlyfinds — Security testing can detect improper exception handling but does not prevent the coding practice itself.
CWE-396mostlyfinds — Security testing in development can detect generic catch blocks, but does not guarantee their removal.
CWE-40mostlyfinds — Security testing can discover and verify the absence of UNC-based path traversal vulnerabilities.
CWE-401mostlyfinds — Security testing in development can detect unreleased memory, providing partial coverage of the weakness.
CWE-403mostlyfinds — Security testing can uncover descriptor leaks but does not prevent them by itself.
CWE-407mostlyfinds — Security testing can uncover performance issues stemming from algorithmic complexity.
CWE-409mostlyfinds — Security testing can uncover decompression-bomb vulnerabilities before release.
CWE-41mostlyfinds — Security testing can detect path-equivalence flaws before release, partially fulfilling the control.
CWE-413mostlyfinds — Security testing can detect locking defects but does not itself implement locking controls.
CWE-414mostlyfinds — Security testing can detect race conditions caused by missing locks but does not prevent them by itself.
CWE-415mostlyfinds — Security testing in development can detect double-free conditions before release.
CWE-416mostlyfinds — Security testing in development can detect use-after-free bugs before release.
CWE-42mostlyfinds — Security testing can detect path-equivalence flaws before release.
CWE-421mostlyfinds — Security testing can detect alternate-channel race conditions before deployment.
CWE-422mostlyfinds — Security testing can discover shatter vulnerabilities but does not itself implement the control's broader acceptance criteria.
CWE-424mostlyfinds — Security testing can discover unprotected alternate paths before release.
CWE-425mostlyfinds — Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.
CWE-426mostlyfinds — Security testing can discover search-path issues but does not itself prevent them in production code.
CWE-427mostlyfinds — Security testing can detect uncontrolled search-path issues but does not prevent them by itself.
CWE-428mostlyfinds — Security testing in development can detect unquoted search-path issues before deployment.
CWE-43mostlyfinds — Security testing can detect path-equivalence flaws before deployment.
CWE-430mostlyfinds — Security testing can detect incorrect handler assignments before deployment.
CWE-431mostlyfinds — Security testing in development and acceptance can detect missing handlers through negative and exception test cases.
CWE-433mostlyfinds — Security testing can detect the weakness but does not itself implement the preventive control.
CWE-434mostlyfinds — Configuration and acceptance testing verify that file-upload handling enforces allowed types and does not permit dangerous content to be stored or executed.
CWE-435mostlyfinds — Security testing during integration and acceptance can reveal interaction-induced weaknesses.
CWE-436mostlyfinds — Security testing can detect and correct cases where one component misinterprets another’s state or messages.
CWE-437mostlyfinds — Security testing can validate that the intermediary correctly handles all documented and undocumented endpoint features.
CWE-44mostlyfinds — Security testing can discover path-equivalence flaws but does not itself prevent them in production.
CWE-440mostlyfinds — Security testing in development and acceptance validates that functions behave as specified.
CWE-444mostlyfinds — Security testing can detect HTTP request smuggling vulnerabilities in intermediary components.
CWE-446mostlyfinds — Security testing in development and acceptance can detect UI discrepancies before release, providing strong mitigation for this weakness.
CWE-447mostlyfinds — Security testing in development and acceptance would detect unimplemented security features before release.
CWE-449mostlyfinds — Security testing in development and acceptance validates that UI actions match user intent and requirements.
CWE-450mostlyfinds — Security testing can detect and require fixes for multiple-interpretation UI input flaws.
CWE-451mostlyfinds — Security testing can detect UI misrepresentation vulnerabilities before deployment.
CWE-453mostlyfinds — Security testing can detect insecure defaults but does not prevent them.
CWE-454mostlyfinds — Security testing can detect the weakness but does not prevent it at design time.
CWE-455mostlyfinds — Security testing in development can detect missing exit-on-failure behavior during initialization.
CWE-456mostlyfinds — Security testing in development and acceptance can detect uninitialized-variable conditions through static and dynamic analysis.
CWE-457mostlyfinds — Security testing can detect uninitialized-variable bugs, but the control is broader.
CWE-46mostlyfinds — Security testing in development can detect path-equivalence flaws before deployment.
CWE-460mostlyfinds — Security testing can detect missing cleanup paths, thereby mitigating the weakness before deployment.
CWE-462mostlyfinds — Security testing can detect duplicate-key conditions before release.
CWE-463mostlyfinds — Security testing can detect sentinel deletion bugs before release.
CWE-466mostlyfinds — Security testing in development can detect out-of-range pointer returns through static analysis and fuzzing.
CWE-467mostlyfinds — Security testing can detect sizeof(pointer) errors but does not prevent them at source.
CWE-468mostlyfinds — Security testing can discover pointer-scaling defects, yet eliminating the weakness itself does not satisfy the control's wider testing mandate.
CWE-469mostlyfinds — Security testing in development can detect pointer-subtraction flaws through static analysis and fuzzing.
CWE-470mostlyfinds — Security testing can detect and block unsafe reflection patterns before release.
CWE-471mostlyfinds — Security testing can detect unauthorized modification paths for assumed-immutable data.
CWE-472mostlyfinds — Security testing in development and acceptance will detect parameter tampering vulnerabilities before deployment.
CWE-473mostlyfinds — Security testing can detect variable-injection flaws but does not itself implement the preventive controls.
CWE-474mostlyfinds — Security testing can surface cross-platform inconsistencies but does not prevent their introduction in code.
CWE-475mostlyfinds — Security testing can detect undefined behavior from invalid API inputs before deployment.
CWE-476mostlyfinds — Security testing can detect NULL dereference defects before release.
CWE-478mostlyfinds — Security testing can detect missing default cases but does not guarantee their prevention.
CWE-479mostlyfinds — Security testing can detect unsafe signal-handler patterns before release.
CWE-480mostlyfinds — Security testing and code review can catch operator errors before release.
CWE-482mostlyfinds — Security testing can detect the flaw but does not prevent it at source.
CWE-484mostlyfinds — Security testing in development can detect unintended fall-through behavior, though it is not the primary control.
CWE-488mostlyfinds — Security testing can detect the weakness but does not itself implement the preventive control.
CWE-489mostlyfinds — Security testing in development and acceptance catches active debug code before deployment.
CWE-491mostlyfinds — Security testing can detect clone-related state corruption during acceptance testing.
CWE-495mostlyfinds — Security testing can detect the weakness but does not itself prevent it at design time.
CWE-499mostlyfinds — Security testing can detect serializable sensitive classes and verify they are properly protected.
CWE-50mostlyfinds — Security testing in development can detect path-equivalence flaws before deployment.
CWE-502mostlyfinds — Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
CWE-507mostlyfinds — Security testing in development and acceptance can uncover hidden malicious behavior.
CWE-511mostlyfinds — Security testing in development and acceptance can uncover hidden logic/time bombs before release.
CWE-515mostlyfinds — Security testing may discover covert storage channels but does not ensure they are absent.
CWE-531mostlyfinds — Security testing in development and acceptance can detect sensitive data left in test code.
CWE-535mostlyfinds — Security testing can detect exposed error messages but does not prevent them by itself.
CWE-539mostlyfinds — Security testing can detect and prevent use of persistent cookies with sensitive data.
CWE-541mostlyfinds — Security testing can detect credentials in include files before deployment.
CWE-544mostlyfinds — Security testing can detect inconsistent error handling but does not itself define the standardized mechanism.
CWE-548mostlyfinds — Security testing in development and acceptance can detect and require remediation of exposed directory listings.
CWE-550mostlyfinds — Security testing can detect and require remediation of verbose error messages.
CWE-551mostlyfinds — Security testing can detect this weakness but does not prevent it by itself.
CWE-553mostlyfinds — Security testing can discover such files but does not prevent their introduction during development.
CWE-561mostlyfinds — Security testing can surface dead code but does not directly prevent or eliminate it.
CWE-562mostlyfinds — Security testing in development can detect use-after-return bugs before release.
CWE-564mostlyfinds — Security testing can detect injection flaws but does not prevent them at design time.
CWE-565mostlyfinds — Security testing can detect cookie-validation flaws but does not itself implement the required controls.
CWE-566mostlyfinds — Security testing in development can detect missing authorization checks and unsafe SQL construction before release.
CWE-567mostlyfinds — Security testing can detect race conditions but does not itself prevent the weakness.
CWE-57mostlyfinds — Requires security testing that can detect path-traversal weaknesses before release.
CWE-570mostlyfinds — Security testing in development and acceptance can surface dead-code paths caused by always-false expressions.
CWE-571mostlyfinds — Security testing in development can surface constant-true conditions through automated checks.
CWE-573mostlyfinds — Security testing can detect specification non-compliance but does not itself prevent the weakness.
CWE-587mostlyfinds — Security testing can detect fixed-address pointer assignments but does not prevent them.
CWE-588mostlyfinds — Security testing can detect memory corruption caused by invalid pointer casts.
CWE-59mostlyfinds — Security testing can detect link-following flaws before release.
CWE-590mostlyfinds — Security testing in development can detect invalid-free defects before release.
CWE-591mostlyfinds — Security testing can discover unlocked sensitive buffers, but does not itself implement the locking mechanism.
CWE-597mostlyfinds — Security testing can detect the flaw but does not prevent its introduction.
CWE-598mostlyfinds — Security testing can detect sensitive data leakage via query strings.
CWE-599mostlyfinds — Security testing could detect missing certificate validation but does not prevent the weakness at development time.
CWE-6mostlyfinds — Security testing can detect and reject applications with insufficient session-ID length.
CWE-600mostlyfinds — Security testing in development can detect uncaught exceptions and verify proper error handling before release.
CWE-602mostlyfinds — Security testing can detect client-side enforcement but is not the primary mitigation.
CWE-603mostlyfinds — Security testing can detect missing server-side authentication checks.
CWE-606mostlyfinds — Security testing in development can detect and block unchecked loop conditions before release.
CWE-61mostlyfinds — Security testing can detect symlink-following vulnerabilities before deployment, covering most of the weakness.
CWE-610mostlyfinds — Security testing can detect instances of the weakness but does not prevent it at design or coding time.
CWE-611mostlyfinds — Security testing in development catches XXE via static analysis and dynamic XML fuzzing.
CWE-615mostlyfinds — Security testing may incidentally discover sensitive comments, but that is not the control’s primary intent.
CWE-616mostlyfinds — Security testing in development can detect the legacy upload pattern before deployment.
CWE-617mostlyfinds — Security testing in development can detect reachable assertions before release, reducing the likelihood of exploitation.
CWE-618mostlyfinds — Security testing can detect unsafe methods but does not itself prevent their introduction.
CWE-62mostlyfinds — Security testing can discover hard-link issues but does not itself prevent them in production.
CWE-621mostlyfinds — Security testing can detect variable extraction flaws before deployment.
CWE-622mostlyfinds — Security testing in development and acceptance would detect missing validation of hook arguments through fuzzing or negative testing.
CWE-623mostlyfinds — Security testing can detect unsafe ActiveX controls, but testing alone does not eliminate the root cause.
CWE-624mostlyfinds — Security testing can detect executable regex flaws before production deployment.
CWE-625mostlyfinds — Security testing can detect permissive regex through fuzzing or negative test cases.
CWE-626mostlyfinds — Security testing can detect null-byte injection flaws before release.
CWE-627mostlyfinds — Security testing can detect dynamic evaluation flaws but does not prevent them by itself.
CWE-628mostlyfinds — Security testing in development can detect argument-related defects before release.
CWE-639mostlyfinds — Security testing can detect missing authorization checks but does not prevent the weakness in production.
CWE-64mostlyfinds — Security testing can uncover shortcut-following flaws but does not itself eliminate the weakness in production code.
CWE-641mostlyfinds — Security testing can detect improper filename handling but does not itself prevent the weakness.
CWE-643mostlyfinds — Security testing in development catches XPath injection vulnerabilities before release.
CWE-644mostlyfinds — Security testing catches header-injection issues before release, covering most of the weakness.
CWE-646mostlyfinds — Security testing can detect the weakness, but the control does not guarantee its elimination.
CWE-647mostlyfinds — Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.
CWE-648mostlyfinds — Security testing can detect incorrect privileged API calls but does not prevent them at design time.
CWE-649mostlyfinds — Security testing can detect missing integrity checks on encrypted or obfuscated security inputs.
CWE-65mostlyfinds — Security testing can detect and block scenarios where applications follow malicious hard links.
CWE-650mostlyfinds — Security testing can detect and prevent vulnerabilities where GET requests cause unintended state changes.
CWE-652mostlyfinds — Security testing in development catches XQuery injection vulnerabilities before deployment.
CWE-657mostlyfinds — Security testing can detect violations of secure design principles before release.
CWE-66mostlyfinds — Security testing in development can detect path-traversal or virtual-resource handling flaws before deployment.
CWE-662mostlyfinds — Security testing can detect synchronization flaws but does not itself implement the required controls.
CWE-663mostlyfinds — Security testing can detect race conditions and re-entrancy issues but does not itself prevent the weakness.
CWE-665mostlyfinds — Security testing can detect uninitialized variables but does not itself enforce initialization practices.
CWE-667mostlyfinds — Security testing can detect race conditions and locking errors before release.
CWE-67mostlyfinds — Security testing in development can detect and prevent device-name pathname vulnerabilities.
CWE-670mostlyfinds — Security testing in development and acceptance can detect paths that deviate from intended logic.
CWE-672mostlyfinds — Security testing can detect use-after-release but does not prevent it at runtime.
CWE-674mostlyfinds — Security testing in development can detect excessive recursion via static analysis or fuzzing.
CWE-675mostlyfinds — Security testing can detect duplicate operations on resources before release.
CWE-676mostlyfinds — Security testing can surface instances of dangerous functions but does not prevent their introduction.
CWE-680mostlyfinds — Security testing can detect integer-overflow-to-buffer-overflow conditions during development.
CWE-681mostlyfinds — Security testing can detect numeric conversion defects before release.
CWE-682mostlyfinds — Security testing in development and acceptance can detect calculation flaws before deployment.
CWE-683mostlyfinds — Security testing in development can detect argument-order defects, yet testing coverage is rarely exhaustive.
CWE-684mostlyfinds — Security testing in development and acceptance validates that implemented functionality conforms to specifications before release.
CWE-686mostlyfinds — Security testing in development can detect type-related defects through unit, integration, and static-analysis testing.
CWE-687mostlyfinds — Security testing in development can detect incorrect argument values before release.
CWE-688mostlyfinds — Security testing can detect argument-related defects but does not prevent them at source.
CWE-690mostlyfinds — Security testing in development can detect missing NULL checks before release.
CWE-691mostlyfinds — Security testing in development and acceptance can detect control-flow weaknesses but does not itself implement preventive controls.
CWE-692mostlyfinds — Security testing can discover incomplete denylists, yet the control does not mandate their replacement.
CWE-694mostlyfinds — Security testing can detect duplicate identifiers before deployment.
CWE-695mostlyfinds — Security testing can detect but does not prevent use of prohibited low-level code.
CWE-696mostlyfinds — Security testing can detect ordering flaws but does not prevent them during development.
CWE-697mostlyfinds — Security testing can detect incorrect comparison flaws before deployment.
CWE-698mostlyfinds — Security testing can detect EAR flaws before deployment.
CWE-704mostlyfinds — Security testing can uncover type-conversion defects before release.
CWE-705mostlyfinds — Security testing can detect control-flow scoping defects before release.
CWE-706mostlyfinds — Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.
CWE-707mostlyfinds — Security testing can detect neutralization flaws but does not itself implement the required controls.
CWE-710mostlyfinds — Testing can detect violations but does not prevent them.
CWE-73mostlyfinds — Security testing can detect path-traversal issues but does not itself implement preventive controls.
CWE-733mostlyfinds — Security testing in development can detect optimization-induced removal of security mechanisms.
CWE-74mostlyfinds — Security testing in development catches injection vulnerabilities before release.
CWE-749mostlyfinds — Security testing can detect exposed dangerous functions, but does not prevent their initial introduction.
CWE-75mostlyfinds — Security testing catches injection vulnerabilities but does not itself implement the sanitization fix.
CWE-754mostlyfinds — Security testing in development and acceptance verifies handling of error and exceptional conditions.
CWE-755mostlyfinds — Security testing in development and acceptance verifies correct handling of exceptional conditions.
CWE-756mostlyfinds — Security testing can detect missing custom error pages and verify they do not leak sensitive information.
CWE-757mostlyfinds — Security testing can detect and block algorithm downgrade vulnerabilities before deployment.
CWE-758mostlyfinds — Security testing can detect some instances of undefined behavior but does not prevent the root weakness.
CWE-759mostlyfinds — Security testing can detect unsalted hashes but does not prevent their introduction.
CWE-76mostlyfinds — Security testing can detect incomplete neutralization but does not prevent the weakness itself.
CWE-760mostlyfinds — Security testing in development and acceptance can detect weak password hashing implementations.
CWE-761mostlyfinds — Security testing can detect the flaw but does not prevent it at the source.
CWE-762mostlyfinds — Security testing in development can detect mismatched alloc/free pairs before release.
CWE-763mostlyfinds — Security testing can detect invalid pointer releases before release.
CWE-764mostlyfinds — Security testing in development can exercise locking scenarios and detect multiple-lock conditions before release.
CWE-765mostlyfinds — Security testing in development can detect resource-state anomalies caused by multiple unlocks.
CWE-767mostlyfinds — Security testing can detect improper exposure of private variables during acceptance.
CWE-768mostlyfinds — Security testing can detect incorrect short-circuit behavior before release.
CWE-77mostlyfinds — Security testing in development catches command-injection vulnerabilities before release.
CWE-771mostlyfinds — Security testing can detect missing references to allocated resources before deployment.
CWE-774mostlyfinds — Security testing can detect unbounded descriptor allocation before release.
CWE-775mostlyfinds — Security testing can detect unreleased descriptors, providing partial coverage of the weakness.
CWE-776mostlyfinds — Security testing can detect and block XML entity-expansion vulnerabilities before deployment.
CWE-777mostlyfinds — Security testing can detect unanchored regex but does not prevent the weakness by itself.
CWE-78mostlyfinds — Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
CWE-780mostlyfinds — Security testing can detect use of RSA without OAEP during development.
CWE-782mostlyfinds — Security testing can detect missing IOCTL authorization during development.
CWE-783mostlyfinds — Security testing can detect logic errors caused by precedence issues.
CWE-784mostlyfinds — Security testing can detect missing cookie validation but does not prevent the weakness by itself.
CWE-786mostlyfinds — Security testing in development can detect and eliminate pre-buffer memory accesses before release.
CWE-787mostlyfinds — Security testing in development and acceptance can detect and prevent out-of-bounds write defects.
CWE-788mostlyfinds — Security testing in development can detect buffer-overrun defects before release.
CWE-789mostlyfinds — Security testing in development can detect and block excessive allocation flaws before deployment.
CWE-79mostlyfinds — Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
CWE-790mostlyfinds — Security testing can detect improper filtering but does not itself implement the filtering control.
CWE-791mostlyfinds — Security testing in development and acceptance can detect incomplete filtering but does not itself implement the filtering.
CWE-792mostlyfinds — Security testing in development and acceptance can detect incomplete filtering but does not itself implement the fix.
CWE-794mostlyfinds — Security testing can detect incomplete filtering but does not itself implement the filtering mechanism.
CWE-80mostlyfinds — Security testing in development catches unneutralized script tags before release.
CWE-804mostlyfinds — Security testing can detect weak CAPTCHA implementations before deployment.
CWE-805mostlyfinds — Security testing in development can detect out-of-bounds accesses, but does not guarantee prevention.
CWE-807mostlyfinds — Security testing in development catches input-validation flaws before deployment.
CWE-81mostlyfinds — Security testing in development and acceptance can detect unneutralized script in error pages but does not itself implement the fix.
CWE-82mostlyfinds — Security testing in development can detect and drive remediation of improper script handling in IMG tags.
CWE-820mostlyfinds — Security testing can detect missing synchronization through concurrency testing.
CWE-821mostlyfinds — Security testing can detect synchronization flaws before production deployment.
CWE-822mostlyfinds — Security testing can detect pointer-dereference flaws before release.
CWE-823mostlyfinds — Security testing can detect out-of-range pointer offsets before release.
CWE-824mostlyfinds — Security testing can detect uninitialized pointer usage before release.
CWE-825mostlyfinds — Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.
CWE-826mostlyfinds — Security testing can detect premature-release bugs, providing partial mitigation.
CWE-827mostlyfinds — Security testing in development can detect XXE vectors arising from uncontrolled DTD references.
CWE-828mostlyfinds — Security testing can detect unsafe signal handlers but does not prevent their introduction.
CWE-83mostlyfinds — Security testing in development catches attribute-injection flaws before release but does not itself implement the fix.
CWE-830mostlyfinds — Security testing can detect the weakness, but does not prevent its introduction during design or coding.
CWE-832mostlyfinds — Security testing may detect the flaw but does not prevent it by itself.
CWE-833mostlyfinds — Security testing in development can detect deadlock conditions through stress and concurrency testing.
CWE-834mostlyfinds — Security testing can detect excessive iteration through stress and fuzz testing.
CWE-835mostlyfinds — Security testing can uncover infinite-loop conditions before release.
CWE-838mostlyfinds — Security testing can detect encoding mismatches, but testing alone does not prevent the weakness at source.
CWE-839mostlyfinds — Security testing in development and acceptance can detect missing minimum checks through boundary-value and fuzz testing.
CWE-84mostlyfinds — Security testing in development and acceptance will detect URI-scheme injection flaws before release.
CWE-841mostlyfinds — Security testing can detect workflow bypasses but does not enforce them at runtime.
CWE-843mostlyfinds — Security testing in development can detect type-confusion vulnerabilities through fuzzing and static analysis.
CWE-85mostlyfinds — Security testing can detect doubled-character XSS, but testing alone does not prevent the weakness from being introduced.
CWE-86mostlyfinds — Security testing can detect the weakness but does not itself implement the neutralization controls.
CWE-87mostlyfinds — Security testing catches residual XSS but does not itself implement the neutralization controls.
CWE-88mostlyfinds — Security testing can detect argument injection but does not prevent it at the source.
CWE-89mostlyfinds — The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
CWE-90mostlyfinds — Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.
CWE-908mostlyfinds — Security testing in development and acceptance can detect uninitialized resource usage through dynamic analysis and fuzzing.
CWE-909mostlyfinds — Security testing can detect missing initialization defects before deployment.
CWE-91mostlyfinds — Security testing catches XML injection during development but does not itself implement the fix.
CWE-910mostlyfinds — Security testing can detect use-after-close defects before release.
CWE-911mostlyfinds — Security testing in development can detect reference-count defects before release, providing partial mitigation.
CWE-912mostlyfinds — Security testing in development and acceptance can discover undocumented functionality before release.
CWE-913mostlyfinds — Security testing can detect dynamic code weaknesses but does not prevent them at design or coding time.
CWE-914mostlyfinds — Security testing can detect and prevent dynamic-variable weaknesses before release.
CWE-915mostlyfinds — Security testing can detect mass-assignment flaws but does not itself prevent them at runtime.
CWE-917mostlyfinds — Security testing in development and acceptance can detect EL injection but does not itself implement the fix.
CWE-925mostlyfinds — Security testing can detect missing intent verification but does not prevent the weakness by itself.
CWE-926mostlyfinds — Security testing can detect exported components lacking proper restrictions, providing partial coverage of the weakness.
CWE-927mostlyfinds — Security testing can detect the weakness but does not itself prevent it at runtime.
CWE-93mostlyfinds — Security testing can detect CRLF flaws but does not itself implement the neutralization.
CWE-939mostlyfinds — Security testing can discover missing authorization checks, but does not itself implement the required controls.
CWE-941mostlyfinds — Security testing can detect incorrect destinations, yet it is a detection rather than prevention control.
CWE-942mostlyfinds — Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.
CWE-943mostlyfinds — Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.
CWE-95mostlyfinds — Security testing in development can detect eval injection vulnerabilities before deployment.
CWE-96mostlyfinds — Security testing in development and acceptance will detect static code injection but does not prevent it at the source.
CWE-97mostlyfinds — Security testing can detect SSI flaws but does not itself implement the neutralization controls.
CWE-98mostlyfinds — Security testing can detect RFI but does not prevent the weakness by itself.
CWE-99mostlyfinds — Security testing can detect resource-injection flaws but does not itself implement preventive controls.
CWE-1007partialfinds — Security testing can detect and require fixes for insufficient visual distinction of homoglyphs.
CWE-1067partialfinds — Security testing can detect slow sequential scans and missing indexes during acceptance.
CWE-1103partialfinds — Security testing in development can include cross-platform compatibility and functionality equivalence tests.
CWE-1124partialfinds — Security testing can detect overly complex code but does not itself prevent the weakness.
CWE-1164partialfinds — Security testing can detect dead code but does not directly prevent its introduction.
CWE-1247partialfinds — Security testing in development can discover and validate protections against voltage and clock glitch attacks.
CWE-1278partialfinds — Security testing can verify the presence of hardware protections against imaging attacks.
CWE-1291partialfinds — Security testing and acceptance criteria can verify that production code is signed with a dedicated key not used for debug builds.
CWE-1300partialfinds — Security testing can include side-channel analysis to verify protections.
CWE-1303partialfinds — Security testing can detect side-channel leakage but does not prevent the underlying microarchitectural sharing.
CWE-1332partialfinds — Security testing in development can discover instruction-skip faults, yet testing alone does not guarantee hardware-level mitigation.
CWE-1342partialfinds — Security testing can include side-channel and transient-execution test suites during acceptance.
CWE-202partialfinds — Security testing can validate that inference attacks are mitigated in data-query functionality.
CWE-385partialfinds — Security testing can uncover timing vulnerabilities but does not prevent their introduction.
CWE-410partialfinds — Security testing can detect insufficient resource pools before deployment.
CWE-448partialfinds — Security testing can detect and flag obsolete UI features that lack appropriate warnings.
CWE-514partialfinds — Security testing can discover covert channels, yet the control does not mandate such specialized testing.
CWE-1116nonenone — Security testing can indirectly catch misleading comments when they cause test failures or misinterpretation.
CWE-1118nonenone — Security testing can expose undocumented error handling but does not require its documentation.
CWE-1176nonenone — Security testing can include performance and load tests that surface inefficient CPU usage.
CWE-656nonedetects — Security testing can expose mechanisms whose only protection is obscurity.

Mitigated MITRE ATT&CK techniques (9)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1068→M T1078→P T1190→M T1210→P T1525→P T1552→P T1553→P

Why these map — AI rationale (under review)

T1068mostlydetects — Testing for insecure configurations, coding flaws, and design weaknesses before release limits the availability of privilege-escalation vulnerabilities that adversaries could exploit after gaining a foothold.
T1190mostlydetects — Security testing and vulnerability scanning of new or upgraded systems before deployment reduces the likelihood that publicly exposed applications contain exploitable flaws that adversaries can use for initial access.
T1078partialdetects — Testing authentication and access-control mechanisms helps ensure that default, local, or domain accounts cannot be trivially abused because weak or missing controls have been identified and corrected.
T1210partialdetects — Pre-deployment penetration testing and configuration validation of remote services and components reduces the chance that lateral-movement paths remain open due to unpatched or misconfigured services.
T1525partialdetects — Independent acceptance testing and vulnerability scanning of new or upgraded systems detect malicious implants or backdoors introduced during development or supply-chain stages.
T1552partialdetects — Security testing that verifies proper handling of credentials and cryptographic functions decreases the probability that credentials or keys are left exposed in files, registries, or configuration stores.
T1553partialdetects — Testing of secure configurations and code signing controls catches misconfigurations or trust-control bypasses that would allow adversaries to subvert code integrity checks.
T1027nonemitigates — Code review and static-analysis testing during development can detect obfuscated or packed payloads, making it harder for adversaries to introduce stealthy code that evades later detection.
T1204nonemitigates — Secure-coding and configuration testing reduce the chance that delivered software contains exploitable flaws that users could be tricked into executing.

Prevented OWASP Web Top 10 (2025) risks (7)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01→P A02→M A04→P A05→M A06→P A07→P A08→M

Why these map — AI rationale (under review)

A02mostlyfinds — Requiring tests of secure configurations for operating systems, firewalls, and other components prevents misconfigured systems from being deployed.
A05mostlyfinds — Code review, vulnerability scanning, and penetration testing against un-anticipated inputs catch injection flaws before release.
A08mostlyfinds — Security testing of in-house and supplier components verifies integrity of code and configurations before they are integrated.
A01partialfinds — Security testing that explicitly validates authentication, access restrictions, and secure coding directly stops broken access control defects from reaching production.
A04partialfinds — Testing the correct implementation and use of cryptographic functions reduces the chance that weak or missing cryptography is introduced.
A06partialfinds — Independent acceptance testing and security requirements validation help ensure insecure design patterns are identified and corrected early.
A07partialfinds — Explicit testing of user authentication functions prevents authentication-related weaknesses from being accepted into production.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.