Method for deriving abuse and misuse cases — cross-functional workshop, adversarial user stories and integration into the requirements backlog. Adversarial elicitation technique that feeds the threat model and the security requirements; it complements structured threat modelling, it does not replace it.
Organisational policy that defines the requirements for the execution of offensive penetration tests (PenTesting), including scope and formal authorisation, test modalities, rules of engagement, minimum report content, the remediation and retest process, cadence by criticality level and integration with the findings process, proportionate to the criticality level (L1, L2, L3).