---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Penetration testing

# Penetration testing {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Penetration Testing

Penetration testing in Application Vulnerability Response allows application owners to evaluate their application's security by engaging an ethical hacking team for manual testing.
This process is essential for identifying vulnerabilities and improving security posture.
Show full answer Show less  

## Key Features

* **Roles Required:**
  * **App-Sec Manager:** Responsible for managing penetration testing requests, including roles for managing requests and reading data.
  * **Ethical Hacker:** Conducts the penetration tests, with roles that enable updating assignments, managing requests, and reading all relevant data.
* **Requesting a Penetration Test:** Starting from version 19.0, requests can be created or copied in the application. Prior versions utilize the ITSM service catalog for requests.
* **Testing Workflow:** The process involves reviewing the assessment request, preparing the testing environment, testing the application, and reporting findings.
* **Reporting Findings:** Findings are documented as manually-created Application Vulnerable Items (AVIs), and SLAs for remediation are defined during reporting.

## Key Outcomes

Upon completion of the penetration test, the ethical hacking team validates and closes the findings after the application team resolves the identified vulnerabilities. Users can utilize the Application Vulnerability Management PA dashboard to track the status of these findings, ensuring ongoing security improvements and compliance.  
Penetration testing in Application Vulnerability Response enables application owners to assess the security posture of their application. It is the manual testing of an application by the ethical hacking team.

## Roles required {#pen_test_overview_avm__section_c25_d3r_qqb}

Penetration testing requires the following roles:

App-Sec Manager: Contains security managers and application owners who manage the penetration testing assessment requests. It contains the following granular roles:  
* sn_vul.app_manage_pen_test_request
* sn_vul.app_read_all
* cmdb_read
{#pen_test_overview_avm__ul_ypv_cbw_xqb}

Ethical Hacker: Contains members of the ethical hacking team who perform penetration testing of applications. It includes the following granular roles:  
* sn_vul.app_update_assignment_group
* sn_vul.app_update_assigned_to
* sn_vul.app_manage_manual_avits
* sn_vul.app_manage_pen_test_request_config
* itil
* sn_vul.app_read_all
* sn_vul.app_manage_pen_test_request
* sn_vul.app_update_state
{#pen_test_overview_avm__ul_elg_q1w_xqb}

For more information about these roles, see [Application Vulnerability Response user groups and roles](https://servicenow-prod.fluidtopics.net/pNl52AMjKjWmG3S5Q_qwiA#avm-manage-roles "Before you can successfully remediate vulnerabilities with Application Vulnerability Response (AVR), you must assign users to user groups.").

Starting with v19.0 of Vulnerability Response, if you are using the Veracode Vulnerability Integration, the penetration assessment tests in the Veracode Vulnerability Integration are manual findings from Veracode. They are not linked to any penetration test assessment requests you configure in Application Vulnerability Response. For more information about penetration test assessments from Veracode, see the [Veracode Vulnerability Integration](https://servicenow-prod.fluidtopics.net/UaJdOAyH3lz8Z703obNHTg "The Vulnerability Response Integration with Veracode application uses data imported from the Veracode product to help you determine the impact and priority of flaws in your code.").

## Life cycle of penetration testing {#pen_test_overview_avm__section_xhp_hj3_qqb}

As an application owner, you can request the ethical hacking team for a penetration test assessment of your application. The ethical hacking team acts on this request and creates penetration test findings. These findings are
manually-created Application Vulnerable Items (AVIs).

The penetration testing workflow covers the penetration testing life cycle from raising the testing request to resolving the findings of the ethical hacking team.

## Requesting a penetration test assessment {#pen_test_overview_avm__section_ob1_xgp_qqb}

Starting with v19.0, you can create new requests or copy existing requests at AllPenetration Test Assessment RequestsAll.

Prior to v19.0, as the application owner, you can request a penetration test assessment for your application using the ITSM service catalog.

## Reviewing the penetration test assessment request {#pen_test_overview_avm__section_c4h_khp_qqb}

The ethical hacking team reviews and assesses the application and the scope of the penetration test assessment request, and adds it to the existing backlog.

## Preparing an environment {#pen_test_overview_avm__section_mgr_rhp_qqb}

The ethical hacking team then sends a request to the application owner to provide an environment for them to start testing. Once the environment is ready, the application owner informs the ethical hacking team.

For more information about configuring test requests, see [Configure penetration testing](https://servicenow-prod.fluidtopics.net/zGLQUnExQaLeexMlt~3E6A "You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.").

## Testing and reporting the penetration test findings {#pen_test_overview_avm__section_dgf_s3p_qqb}

The ethical hacking team tests the application and reports the findings to the application owner. The ethical hacking team also defines the Service Level Agreements (SLAs) for the penetration test findings using the remediation target date. These findings are the manually-created AVIs. The application owner in turn reviews the AVIs created by the ethical hacking team. They plan the fixes and assign them to the application team.  
Note:  
Remediation target rules do not apply to the penetration test findings.

The ethical hacking team can create a library of Application Vulnerability Entries (AVEs) and reuse them while reporting the AVIs. They can also track the status of the penetration test findings.

## Fixing and validating the penetration test findings {#pen_test_overview_avm__section_vpq_lkp_qqb}

After the penetration test findings are fixed and resolved by the application team, the fixes are validated manually and closed by the ethical hacking team.

## Application Vulnerability Management reports {#pen_test_overview_avm__section_hjr_ylp_qqb}

Use the reports available on the Application Vulnerability Management PA dashboard to track the penetration test findings.
Figure 1. Penetration testing life cycle

*[\>]: and then