Choose a security assessment by the question it must answer. Scanning, penetration testing and code review provide different evidence and work best with a clear scope.
Use vulnerability assessment for breadth
Start with a verified inventory and authenticated checks where appropriate. Scanning helps identify missing updates, exposed services and configuration weaknesses across many assets. Validate important results before assigning urgent work. A scanner label is not proof of exploitability, and an asset absent from the inventory cannot be covered by the assessment.
Use penetration testing to examine attack paths
A penetration test explores whether weaknesses can be combined to reach an agreed objective, such as crossing an application authorisation boundary. Define permitted systems, identities, time windows and operational limits in writing. The result describes the paths tested and demonstrated; it does not establish that every possible attack has been excluded.
Use code review for logic and trust boundaries
Review authentication, authorisation, input handling, sensitive data flows and dependencies in their application context. Pay attention to actions across tenants and to checks performed only in the interface. Automated tools support review but do not replace reasoning about business rules. Tie findings to the relevant revision and verify fixes against the updated implementation.
Combine evidence into one remediation plan
For a critical application, scanning may establish baseline hygiene, a test may demonstrate impact and code review may explain the root cause. Consolidate duplicate findings and assign one owner per fix. Request retest criteria at procurement time. TRUST-IT can help select the combination appropriate to your application, infrastructure and operational constraints.