Penetration Testing is one of the essential tasks for the security of mobile apps. Choosing between automated and manual testing is a dilemma for many companies. This article walks you through the major aspects of automated vs. manual penetration testing and the driving factors to choose between automated and manual penetration testing.

Source: http://www.liquidyn.com/uploads/pics/665x310-prozessautomation.jpg

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Advantages of automated tools

1. Speed:

Automated tools work faster. During a penetration test, a complete manual approach would always need more time than what is required in an automated approach.

2. Coverage:

Manual testing cannot possibly cover everything from A to Z. This is harder due to the obvious reasons such as time and skills, whereas automated tools can do it with a little bit of human intervention. An example would be, "guiding an automated tool on what to cover during your pentest by performing manual crawling and then analyzing the reported vulnerabilities". During a mobile app pentest, this is very helpful when testing backend APIs.

3. Number of tests:

Automated tools are the perfect fit for testing a target for more of attacks with large number of payloads as it can do it even with a thousand different payloads for one single test. Hence, automated tools can cover the breadth.

4. Skill Set

As mobile security is relatively new subject and not many resources are available on the Internet, having a person with good mobile security skills is little difficult.

Specifically in the case of mobile apps, running an automated tool is relatively easier than doing a manual penetration test. A manual penetration test obviously requires an expert or a team of experts.

5. Reporting

A nice and clean report with just one click is a great advantage with automated tools to save a lot of time. Creating a penetration test report manually is obviously a time-consuming task. Most of the automated tools today also provide a way to customize the final report based on your requirements.

Advantages of the Manual Approach:

1. Testing for Business Logic vulnerabilities:

Automated tools are weak when it comes to testing for business logic vulnerabilities. Manual efforts are needed to do business logic testing.

2. Updating the knowledge base:

When there is a new vulnerability/exploit released, most of the automated tools have to wait for the next update in order to use it in their tests, whereas a human can learn about a new technique and implement it the very next day. However, this again requires a skilled expert.

3. False Positives:

With automated tools, the false positive rate is considered high. Some manual analysis is required to confirm the reported vulnerabilities.

So Manual or Automated?

As mentioned earlier, sometimes it is not possible to cover the ins and outs of the target system or perform fuzzing manually using large number of payloads. In such cases, we can use an automated tool to do our job. It saves a lot of manual effort and time.

Automated tools can also be used for information gathering techniques, which can be very useful before starting the discovery phase. Hence, in such cases, we can use an automated tool to find the right target after which we can use manual assessment to exploit the vulnerability.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Even in cases where the size of the application is large, an automated security scan comes handy. However, the result given by the automated tool isn't necessarily the conclusion. A manual analysis is often required to confirm the vulnerabilities. Manual techniques are also helpful in finding business logic flaws. Thus, a mix of both automated and manual testing would be the best fit to save time and get the best output.