Penetration testing methodologies: PTES, OWASP WSTG and NIST SP 800-115
In short: A methodology makes penetration testing consistent, thorough and repeatable. PTES describes the whole engagement, OWASP WSTG gives detailed web test cases, and NIST SP 800-115 frames testing in four phases. Most testers blend them into their own documented approach.
Why use a methodology?
Two testers given the same target without a method might produce very different results, one thorough, one shallow. A methodology gives a repeatable structure so that coverage is consistent, nothing important is skipped, evidence is kept properly and clients can compare tests over time. It also protects the tester: following a documented, authorised method shows professional conduct.
The main published methodologies
| Methodology | Focus | Best used for |
|---|---|---|
| PTES (Penetration Testing Execution Standard) | The full engagement, from pre-engagement to reporting | Structuring any test end to end |
| OWASP WSTG (Web Security Testing Guide) | Detailed test cases for web applications | Web and API testing checklists |
| NIST SP 800-115 | Technical guide to security testing and assessment | Government and policy-aligned programmes |
| OSSTMM (Open Source Security Testing Methodology Manual) | Measurable testing of operational security | Metrics-driven assessments |
| MITRE ATT&CK (a knowledge base, not a method) | Real attacker techniques | Planning red and purple team scenarios |
How the phases fit together
PTES describes seven stages: pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. Pre-engagement covers scope and permission; threat modelling asks which assets matter and which attackers are realistic, so testing effort is aimed well.
NIST SP 800-115 groups the same work into four phases. Its key insight is the loop between discovery and attack: gaining access often reveals new systems and information, which sends the tester back to discovery.
The OWASP WSTG is organised by test area rather than phase, for example information gathering, configuration, identity management, authentication, authorisation, session management, input validation, error handling, cryptography, business logic and client-side testing. Testers use it during the analysis and exploitation phases of a web test, and each test has an ID that can be cited in reports.
Applying a methodology in practice
- Pick a framework for the overall engagement (often PTES-style phases).
- Add a detailed checklist for the target type, such as WSTG for web applications.
- Write your own internal methodology document that references them and fits your contracts.
- Keep timestamped notes and evidence for every action, so findings are reproducible.
- Review the method after each engagement and update it as techniques change.
In the UK, accredited schemes such as CREST and the NCSC CHECK scheme assess whether testing companies follow sound methods. Examiners for certifications also expect you to name the phases in order.
Tip: a methodology is a floor, not a ceiling. Checklists ensure coverage, but the most valuable findings often come from thinking about how the business actually uses the system.
Practice
Which methodology would you use as a detailed checklist for testing a web application?
Name the four phases in NIST SP 800-115.
Why does PTES include threat modelling before vulnerability analysis?
Key takeaways
- Methodologies make tests consistent, thorough and defensible.
- PTES covers the whole engagement in seven stages.
- OWASP WSTG gives detailed web test cases with citable IDs.
- NIST SP 800-115 uses planning, discovery, attack and reporting, with a discovery-attack loop.
- Most teams blend frameworks into their own documented method.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.