Pentesting Frameworks: OWASP & NIST Guide

The OWASP Testing Guide and NIST SP 800-115 are the two standards that most often shape how a professional penetration test is scoped, executed, and reported. This guide explains what each document is, how they differ, how they work together on one engagement, and how to check that a provider is using them rather than namechecking them.

What Are Pentesting Frameworks?

A pentesting framework is a structured methodology that defines how penetration testing is scoped, executed, and reported.

Frameworks exist so testers apply the same categories of work in a consistent, repeatable, and comprehensive way instead of relying on ad-hoc hunting.

This guide focuses on the OWASP Testing Guide (WSTG) and NIST SP 800-115. Other documents such as PTES and OSSTMM exist, but they sit outside the primary scope here.

Frameworks are necessary but not sufficient. They define what should be considered for testing. They do not automatically produce a high-quality test. A provider can follow a framework poorly, so adherence must be judged alongside scoping discipline, exploitation judgement, and reporting quality.

That distinction matters when you evaluate services. An ad-hoc test can find interesting issues and still miss whole classes of work. A framework-driven test makes the intended coverage visible, so you can see what was in scope, what was deferred, and why. The framework is still only a map. Delivery quality is the journey.

What Is the OWASP Testing Guide (WSTG)?

The OWASP Testing Guide (WSTG) is a comprehensive framework for testing the security of web applications, published by the Open Worldwide Application Security Project (OWASP). It is the document to use when you need structured, repeatable, deep web application testing rather than a high-level risk list.

WSTG organises work as test cases grouped by category. Typical categories include:

• Identity management
• Authentication
• Authorisation
• Session management
• Input and data validation
• Error handling
• Cryptography
• Business logic
• Client-side testing

WSTG is not a flat checklist. A professional engagement uses it to decide which test cases apply to a given application and which high-risk categories take priority. The framework defines what can be tested. Judgement decides what not to test given scope, architecture, and risk. For example, a customer portal with complex roles should spend more time on authorisation and session handling than on a low-risk static brochure page.

If a provider says they test to OWASP, ask whether they mean WSTG test cases or only the Top 10 awareness list. The first is a methodology. The second is a ranking of common issues. Mobile and API work can borrow the same thinking, but WSTG itself is written for web application testing depth.

What Is NIST SP 800-115?

NIST SP 800-115 is the National Institute of Standards and Technology's technical guide for information security testing and assessment. It is a national-level technical standard for assessing networks, systems, and applications, not a web-only catalogue of test cases.

NIST SP 800-115 organises an assessment into four phases:

The standard covers networks, systems, and applications. That is why it is useful when the question is not only whether a web app is weak, but how to run a defensible technical assessment from authority through evidence. It still does not prescribe every exploit path. It tells testers how to plan, discover, attack, and close the work.

NIST SP 800-115 is not a compliance checklist. It describes steps and methods. A provider using it well still applies judgement. The standard structures how expertise is deployed. It does not replace that expertise. Treating it as a box-ticking certificate is a common misconception.

For UK organisations, NIST technical guidance often complements NCSC expectations and the security-testing duties that sit around GDPR. That is a mapping conversation, not a claim that NIST replaces UK regulation.

OWASP vs NIST — A Direct Comparison

OWASP WSTG is for web application testing depth. NIST SP 800-115 is for end-to-end technical security assessment across planning, discovery, attack, and post-assessment. Neither is universally better. They serve different scopes and usually complement each other.

Most professional engagements are not either/or. NIST often owns the operating picture. OWASP often owns web depth inside that picture. A useful mental model is NIST for how the engagement runs and OWASP for how thoroughly the web surface is examined.

How OWASP and NIST Work Together on One Engagement

A professional pentest often blends both frameworks: NIST SP 800-115 defines the overall process, and OWASP WSTG supplies web application testing detail inside those phases. Using both is a sign of maturity, not overcomplication.

Most articles ask which framework you should use. A better question is how the engagement uses both frameworks to avoid blind spots. OWASP supplies test-case depth NIST does not. NIST supplies engagement structure OWASP does not. A NIST-only web test is often shallow. An OWASP-only engagement can lack planning, discovery, and evidence discipline.

This is the approach used on client engagements at Pentesting Company: TEST. FIND. FIX. PROTECT. Framework adherence belongs in the methodology of a live penetration testing service, not only in a proposal sentence. See how that methodology is described on the Penetration Testing Services page.

What a Framework-Aligned Report Should Show

Framework alignment is visible in the report structure, not just the proposal. A namecheck in a quote is not evidence that WSTG or SP 800-115 shaped the work.

A framework-aligned report should contain:

• Findings mapped to specific OWASP WSTG categories, such as injection, broken access control, or security misconfiguration
• Evidence traceable to test cases, not only a scanner export
• Severity ratings that stay consistent with framework thinking rather than arbitrary labels
• Remediation prioritisation based on attack-path risk

NIST SP 800-115-aligned reports typically follow the phase structure and evidence requirements: scoping, test plan, evidence, findings. Mapping makes the deliverable usable for developers and easier to defend to auditors or a board.

Many providers say they use OWASP. Few can show how findings were mapped to WSTG categories. Ask for a sample report that shows the mapping. That is the fastest way to see whether the framework is core delivery or brochure language.

How to Choose the Right Framework for Your Organisation

The right framework choice follows your asset type, compliance pressure, risk appetite, and the need to demonstrate due diligence, not a one-line claim that OWASP is for web and NIST is for enterprise.

• If the focus is a web application such as e-commerce, a customer portal, or a SaaS product, treat OWASP WSTG as the primary depth layer.
• If the environment is broader infrastructure or a regulated setting such as finance, healthcare, or the public sector, treat NIST SP 800-115 as the primary structure and keep OWASP for web components.
• If a compliance driver exists, ask the provider to map the report to the relevant framework controls and evidence requirements.
• If you must demonstrate due diligence to auditors or a board, NIST SP 800-115 gives a defensible structure and OWASP gives testing depth for web surfaces.

Risk appetite also matters. A high-change product team may want WSTG depth on the features that handle money, identity, or personal data. A programme that must show a complete assessment trail may need SP 800-115 artefacts even when the main target is a web app.

Before You Engage a Provider — 5 Questions to Ask About Frameworks

The five questions below test whether a provider genuinely follows the frameworks they claim. A strong answer is specific, names categories or phases, and offers evidence. A weak answer is a generic we use OWASP line with no mapping.

Watch for providers that claim OWASP alignment but deliver reports with no OWASP categories, no mapped findings, and no test-case traceability. Framework language without that evidence is a checkmark, not a quality control.

Frequently Asked Questions

Conclusion — The Framework Is the Map, Not the Journey

OWASP WSTG is the web application testing methodology. NIST SP 800-115 is the technical security testing process guide. Together they tell you what to test and how the engagement should run.

Frameworks are necessary but not sufficient. They define structure. The differentiator is the quality of the provider’s judgement. Treat a framework as a quality signal, not a shield or a checkmark on its own. Look for evidence of application in the engagement and in the report.

Talk to a provider who can demonstrate how they apply OWASP and NIST in practice. If you want to see how Pentesting Company applies these frameworks on a real engagement, walk through the methodology and a sample report via the Penetration Testing Services page.

Frequently Asked Questions