Security Readiness, Application, and Physical Testing

Security Testing in the 2026 Outline

Subdomain 5.5, Understand security testing, has three parts: security readiness testing (blue, purple, and red teaming), application testing (vulnerability scanning, static analysis, dynamic analysis, and threat modeling), and physical penetration testing (phishing, tailgating, and impersonation). The CC outline page describes entry-level staff supporting these tests rather than leading them.

Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 5.5, and CC outline page, checked 2026-10-22.

Readiness Testing: Blue, Purple, and Red

• Red teaming simulates an attacker to find weaknesses.
• Blue teaming defends and detects, and tests how well monitoring and response work.
• Purple teaming brings the two together so attack and defense findings are shared and improved together.

These are the standard meanings of the three terms the outline names.

Application Testing Methods

• Vulnerability scanning checks systems and applications for known weaknesses.
• Static analysis examines code or configuration without running it.
• Dynamic analysis tests a running application.
• Threat modeling asks what could go wrong with a design before it is built.

Physical Penetration Testing

Physical penetration testing checks whether people and facilities resist unauthorized entry. The outline's examples are phishing, tailgating (following an authorized person through a secured door), and impersonation (pretending to belong). A test result is useful only if it leads to a fix, such as a badge procedure, a challenge rule, or awareness training, followed by a retest.

Scenario: The Test Report

A tester follows an employee through a secured door. The finding is not that the door failed; it is that staff do not challenge unknown people. The remediation is awareness training and a challenge procedure, followed by a retest to confirm the change works.