When development is outsourced, a documented baseline of expected functionality sets expectations for both the client and developer. Acknowledging that agile practices are flexible, beware the trap of rushing requirements just because you know they are going to change. It's still essential to be as accurate as you can.

A typical tester mimics end-users, who are constructive when exploring an application’s functionality. But the role of a security tester is different. Their focus is mainly on mimicking hackers, who are intentionally destructive. A solid security strategy should balance both constructive and destructive efforts.

Thought leaders from the software community are taking over the TechWell Hub to answer questions and engage in conversations. Shachar Schiff, founder and principal consultant at BadTesting, hosted this Slack takeover and discussed assessing code coverage like a risk analyst, risk assessments outside security, and more.