OSSTMM

The Open Source Security Testing Methodology Manual — measurable security, beyond checklists.

What It Is

The Open Source Security Testing Methodology Manual is developed and peer-reviewed by ISECOM. Rather than a pass/fail checklist, OSSTMM is built around measurable security metrics — concepts like attack surface and "rav" (risk assessment values) — so that security posture can be tracked and compared over time, not just reported as a list of findings.

Why It's Still Relevant

OSSTMM is one of the few major methodologies that explicitly covers physical and human/social-engineering security testing alongside technical testing, giving it a broader scope than frameworks focused purely on applications or networks. Its emphasis on quantifiable metrics rather than checklist-only reporting makes it especially useful in mature security programs that need to demonstrate measurable improvement between engagements, not just a snapshot of current findings.

Phases, as Implemented in SecurAppt

Information & Data Controls

Scanning

Vulnerability Assessment

Exploitation

Personnel Security Testing

Physical Security Testing

Reporting

Run an OSSTMM-Guided Pentest Session

SecurAppt automatically surfaces the right tools for each OSSTMM phase.

Start a Pentest Session