A professional pentest is not improvised: it relies on recognized methodologies and standards that provide rigor, coverage, and credibility. These frameworks are the industry's "best-practices manual": they ensure you don't leave any area unassessed, they make the work comparable and auditable, and they give the client confidence that you follow an internationally recognized process. In this lesson—the last of the module—we will get to know the five most important reference frameworks (PTES, OWASP WSTG, OSSTMM, NIST SP 800-115, and MITRE ATT&CK), we will see what each is for and when to use it, and we will decide how to combine them in the audit of TechNova S.L.

Understanding these frameworks sets you apart as a professional: anyone can launch tools, but following a recognized methodology is what turns a series of loose tests into a serious audit.

1. Why use methodologies and standards
2. PTES — Penetration Testing Execution Standard
3. OWASP WSTG — web testing guide
4. OSSTMM — security testing methodology manual
5. NIST SP 800-115 — NIST technical guide
6. MITRE ATT&CK — framework of tactics and techniques
7. Comparison table and combination for TechNova

A methodology provides:

• Coverage: a systematic checklist of what to test so you don't miss anything.
• Repeatability: two auditors following the same framework arrive at comparable results.
• Credibility: being able to say "we follow PTES and OWASP WSTG" conveys professionalism and eases compliance.
• Common language: shared terms that facilitate communication with the client and with other professionals.

It is worth distinguishing two things that are often mixed up:

• A methodology describes how to carry out the complete process (phases, activities, deliverables): PTES, OSSTMM, NIST 800-115.
• A catalog or reference framework enumerates what to test or what an adversary does: OWASP WSTG (for web) and MITRE ATT&CK (tactics and techniques).

They are not mutually exclusive: in practice they are combined, as we will see with TechNova.

PTES is a standard that describes a pentest from start to finish in seven stages, closely aligned with the cycle of phases we saw in lesson 01-03:

1. Pre-engagement interactions: scope, contract, RoE.
2. Intelligence gathering (reconnaissance).
3. Threat modeling.
4. Vulnerability analysis.
5. Exploitation.
6. Post-exploitation.
7. Reporting.

What it's for: as the backbone of the entire engagement. It is an excellent general guide because it covers everything from the commercial and legal side to the final report.

When to use it: when you want a global structure for the whole project, whatever type it is. It is the "umbrella" framework that organizes the other pieces.

The OWASP Web Security Testing Guide (WSTG) is the reference par excellence for testing web applications. It is not a complete project methodology, but a detailed and highly practical catalog of what to test in a web app, organized by categories (authentication, session management, input validation, business logic, etc.), with concrete test cases.

OWASP (Open Worldwide Application Security Project) also maintains other well-known resources, such as the OWASP Top 10 (a list of the most critical web risks), which serves as a high-level summary.

What it's for: to make sure you don't leave any type of web flaw untested. It is exhaustive and designed for real-world work.

When to use it: whenever the scope includes a web application—exactly TechNova's store case. It combines naturally with PTES: PTES sets the process; the WSTG details the web tests within the corresponding phase.

The OSSTMM (Open Source Security Testing Methodology Manual) is a more scientific and rigorous methodology, oriented toward measuring security in a quantifiable way. It covers several "channels" (human, physical, wireless, communications, and data) and seeks objective, repeatable results.

What it's for: for audits that require a measurable and formal approach, beyond "we found these flaws."

When to use it: in contexts that value methodological rigor and measurement (formal audits, environments that need metrics). It has a steeper learning curve than PTES.

NIST SP 800-115 ("Technical Guide to Information Security Testing and Assessment") is a guide published by the US standards body (NIST). It offers a structured approach to security testing in four phases (planning, discovery, attack, and reporting) and is highly valued for its institutional backing.

What it's for: as a recognized and citable reference, especially useful when there are compliance requirements or when working with government agencies and large organizations.

When to use it: when the client needs to align with an official standard or when regulatory compliance is a factor. It is more general than PTES in terms of techniques, but very solid as a formal reference framework.

MITRE ATT&CK is not a pentesting methodology, but a knowledge base of the tactics and techniques that real adversaries use, observed in real-world attacks. It organizes attacker behavior into tactics (the "why": initial access, privilege escalation, lateral movement, exfiltration...) and techniques (the concrete "how" of each tactic).

What it's for: as a common language between the offensive and defensive teams. It lets you describe every action of the audit with a standard identifier (for example, an "initial access" technique), which makes it far easier for the defensive team to understand and detect what happened. It is especially useful in the reporting phase and in red team exercises.

When to use it: to map your findings to the behavior of real adversaries and to connect the pentest with defense (detection and response). In this course we will use it as a reference framework to put a standard name to the techniques we apply.

The following table summarizes the five frameworks:

The professional key is to understand that these frameworks don't compete, they complement each other. This is how we will combine them in TechNova's audit:

Specifically, for TechNova:

• PTES will be the master framework that organizes the whole project (it fits with the phases from lesson 01-03).
• OWASP WSTG will guide the testing of the tienda.technova.lab store, ensuring complete web coverage.
• NIST SP 800-115 provides formal backing if TechNova needs to justify the process to third parties.
• MITRE ATT&CK will give us the vocabulary to describe each technique in the report and make it easier for TechNova's defensive team to detect and remediate it.

We will not use OSSTMM as the primary framework in this case, to avoid adding unnecessary complexity, but it is good to know it in case a future client demands a more quantitative approach.

This way, every offensive technique we apply in the coming modules will have its place in a methodology (where it fits in the process) and its standard name (which ATT&CK tactic/technique it represents), in addition to its defensive counterpart. That is the level of rigor expected of a professional.

• Choosing a single framework for everything. No framework covers everything on its own; the professional approach is to combine them according to the scope.
• Confusing methodology with catalog. PTES/OSSTMM/NIST describe the process; OWASP WSTG and MITRE ATT&CK describe what to test or what the adversary does. They are used together.
• Following the framework mechanically. Methodologies are guides, not substitutes for judgment. Adapt them to the client's context.
• Ignoring MITRE ATT&CK in the report. Naming the techniques with a common standard multiplies the report's usefulness for the defensive team.
• Tip: when planning an audit, first choose the master framework (usually PTES) and then add the specific catalogs according to the surfaces in the scope.

Exercise 1. A client asks you to test only their web application. Which framework would you use as the global structure of the project, and which one to ensure coverage of the web tests? Justify it.

Exercise 2. Explain in your own words the difference between a process methodology (such as PTES) and a framework of tactics and techniques (such as MITRE ATT&CK), and why they are used complementarily.

Exercise 3. For TechNova's report, you want the defensive team to understand exactly which techniques were used and how to detect them. Which framework is most useful for that goal and why?

Solution 1. As the global structure I would use PTES, because it organizes the whole project from start to finish (from pre-engagement to reporting), whatever the surface. To ensure coverage of the web tests I would use the OWASP WSTG, which is the detailed and exhaustive catalog of web-application-specific checks. PTES sets "how the project is organized"; the WSTG details "what to test" within the web testing phase.

Solution 2. A process methodology such as PTES describes how to carry out the complete project: its phases, activities, and deliverables, in order. A framework of tactics and techniques such as MITRE ATT&CK describes what a real adversary does (its objectives and the concrete methods), without dictating the project's process. They complement each other because PTES tells you when and in which phase you act, while ATT&CK gives you a standard name for what you are doing at each moment; together they provide structure and a common language.

Solution 3. MITRE ATT&CK. It is the most useful for that goal because it catalogs the adversary's tactics and techniques with standard identifiers that are widely known by defensive teams. By describing each action of the audit with its corresponding ATT&CK technique, TechNova's defensive team can directly locate the associated detection and response recommendations, closing the loop between the simulated attack and the real defense.

With this lesson we close Module 1. We have seen that a professional pentest relies on recognized frameworks: PTES as the master process methodology, OWASP WSTG for thoroughness on web, OSSTMM and NIST SP 800-115 as formal methodological references, and MITRE ATT&CK as the common language of tactics and techniques that connects attack with defense. And we have decided how to combine them in TechNova's audit to achieve rigor, coverage, and credibility.

With this, the framework of the audit is complete: we know what pentesting is (01-01), which type we will do (01-02), which phases we will go through (01-03), under which ethical-legal rules (01-04), and with which methodology (01-05). The time has come to move into action. In Module 2: Reconnaissance, we will take the first real step of the cycle on TechNova: we will start gathering information about tienda.technova.lab and the network 10.10.10.0/24, applying passive and active reconnaissance within the scope and the Rules of Engagement we have just established.