Penetration Testing Methodology Explained: OWASP WSTG, PTES, NIST and OSSTMM

A penetration testing methodology is the structured process a tester follows from the first scoping call to the final report. It makes sure nothing important is skipped and that two tests of the same system produce comparable results.

When you hire a provider, asking which methodology they follow is one of the quickest ways to judge their quality. This guide explains the four best-known frameworks and how they are used in practice. If you are new to the topic, start with what is penetration testing.

Why a methodology matters

Without a methodology, a test depends entirely on what one person remembers to check that day. A defined process brings three benefits:

• Coverage. Checklists make sure common weaknesses are always tested.
• Consistency. Results can be compared from year to year and between systems.
• Defensibility. Auditors and regulators can see how conclusions were reached.

However, a methodology is a floor, not a ceiling. The best testers follow the framework and then go further, especially on business logic.

OWASP Web Security Testing Guide (WSTG)

The OWASP Web Security Testing Guide is the most widely used reference for testing web applications and APIs. It is maintained by the Open Worldwide Application Security Project as a free, open document.

The WSTG groups its tests into areas such as:

• Information gathering
• Configuration and deployment management
• Identity, authentication and authorisation
• Session management
• Input validation, including injection
• Error handling and cryptography
• Business logic
• Client-side testing
• API testing

Each test has an ID, so a report can point to exactly which checks were performed. For web and mobile back-ends, WSTG is usually the primary reference. It also pairs naturally with the OWASP Top 10, which summarises the most critical risk categories.

PTES: Penetration Testing Execution Standard

PTES describes the full lifecycle of a penetration test rather than a list of individual checks. It defines seven phases:

1. Pre-engagement interactions. Scope, rules of engagement, contacts and legal authorisation.
2. Intelligence gathering. Open-source and active reconnaissance of the target.
3. Threat modelling. Identifying valuable assets and likely attackers.
4. Vulnerability analysis. Finding weaknesses with tools and manual work.
5. Exploitation. Proving which weaknesses can be used.
6. Post-exploitation. Understanding the value of compromised systems and how far an attacker could move.
7. Reporting. Communicating findings and fixes to technical and business readers.

PTES is especially useful for network and infrastructure tests, where the path from first foothold to sensitive data matters most.

NIST SP 800-115

NIST Special Publication 800-115, the Technical Guide to Information Security Testing and Assessment, comes from the US National Institute of Standards and Technology. It describes four phases: planning, discovery, attack and reporting.

NIST SP 800-115 is broader than penetration testing alone. It also covers reviews, scanning and other assessment techniques. As a result, it is popular with government agencies and organisations that already align their security programme with NIST frameworks.

OSSTMM

The Open Source Security Testing Methodology Manual, published by ISECOM, takes a more scientific approach. It focuses on measuring operational security across channels such as human, physical, wireless, telecommunications and data networks. OSSTMM also introduces metrics for comparing security levels over time.

In practice, OSSTMM is less commonly used as a day-to-day checklist. Even so, its ideas about measurable, repeatable testing influence many professional teams.

Comparing the frameworks

Each framework answers a slightly different question:

• OWASP WSTG tells you what to test in a web application or API.
• PTES tells you how to run a penetration test from start to finish.
• NIST SP 800-115 places testing within a wider assessment programme.
• OSSTMM focuses on measuring operational security.

Consequently, most professional teams combine them. A typical web application test follows the PTES lifecycle, uses WSTG test cases, and reports risk in a way that maps to the client’s own framework, such as NIST or ISO/IEC 27001.

How RC.MY applies a penetration testing methodology

Our team follows the same principles on every engagement:

1. We agree scope and rules of engagement in writing before any testing starts.
2. We use OWASP WSTG for web, API and mobile back-end testing, and PTES phases for network and infrastructure work.
3. We combine automated tools with manual testing, with extra time for business logic and access control.
4. Every finding includes evidence, a risk rating and practical remediation advice.
5. Retesting is included, so you can confirm that fixes work.

For deeper adversary simulation beyond a scoped test, read what is red teaming.

Frequently asked questions

Which penetration testing methodology is best?

There is no single best methodology. For web applications, OWASP WSTG is the strongest reference. For the overall engagement process, PTES and NIST SP 800-115 are widely accepted. Good providers combine them.

Should the methodology appear in the report?

Yes. A report should state which standards were followed and which test cases were performed, so that you and your auditors can understand the coverage.

Do methodologies replace experienced testers?

No. A methodology ensures coverage, but finding complex attack chains and logic flaws still depends on the skill of the tester.

Talk to a licensed team

RC.MY is a NACSA-licensed penetration testing provider. Learn more about our penetration testing services or get in touch to discuss your scope.