An Analysis of Adversarial Cyber Testing Practice

Researchers at the Johns Hopkins University Applied Physics Laboratory recently conducted a series of structured interviews with a cross section of professionals engaged in adversarial cyber (AC) testing. The team analyzed interview transcripts using grounded theory techniques to discover emergent AC testing themes. This paper presents observations on the current state of AC practice, including its strengths and weaknesses. Overall, researchers noted a diversity of practice in the AC test discipline, reinforcing a need to further study the reproducibility of AC test results and the strength of conclusions that an organization may draw based on the outcome of any single AC test engagement.