A short plan for this quarter
Start with what you can observe. Check how many failed sign-ins your application sees in a day and from how many sources. Find out whether staff and admin accounts require a second factor. List the pages that accept a password.
If you have questions about scope or how testing handles real user accounts, the answers on account testing, evidence and attacker scope are a good start. For a live run and an intent assessment of your own sign-in flows, schedule an as
sessment where operators scope your login testing. Or read more about how TexaTenet operators connect attacker intent to real fixes.
... moreless ...