Open Source Security Testing Methodology Manual · Published by ISECOM
The Open Source Security Testing Methodology Manual (OSSTMM) is a peer-reviewed methodology for performing security tests and metrics, developed and maintained by the Institute for Security and Open Methodologies (ISECOM). Unlike other testing frameworks that focus primarily on finding vulnerabilities, OSSTMM takes a scientific approach to security testing by measuring the actual attack surface and quantifying security through its Risk Assessment Values (RAV) scoring system.
OSSTMM version 3 defines five channels of security testing: Human Security, Physical Security, Wireless Communications, Telecommunications, and Data Networks. Each channel is tested for operational security, controls, and limitations using a consistent set of testing modules. The methodology's emphasis on measurable security outcomes rather than subjective risk ratings makes it particularly valuable for organisations that need to demonstrate security improvements over time or compare security posture across different systems and environments.
OSSTMM's comprehensive scope, covering physical, human, and technical dimensions, makes it well-suited for organisations seeking a holistic security assessment rather than purely technical testing. The methodology is freely available under a Creative Commons licence, and its structured approach to quantifying security helps organisations move beyond checkbox compliance toward genuine security improvement.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.
US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.
Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.
Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.
Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.
Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.
Berlin-headquartered German cybersecurity consultancy with 30+ years of BSI IT-Grundschutz experience. Trusted by federal agencies, DAX corporations, and critical infrastructure operators.
Established Ely-based compliance and cybersecurity consultancy offering CREST-approved penetration testing as part of a comprehensive governance, risk management, and compliance portfolio.
Creators of OSCP, Kali Linux, and Exploit-DB, offering penetration testing services from the team that trains the world's ethical hackers.
Swiss cybersecurity firm with major Singapore operation. CREST accredited, CSA-licensed in Singapore. Manual exploitation focus with the proprietary MAD reporting platform.
Airbus group cybersecurity consultancy with ANSSI PASSI qualification. Aerospace, defence, and critical infrastructure penetration testing across Europe.
OSSTMM uniquely focuses on measuring security quantitatively through its RAV scoring system, rather than simply finding vulnerabilities. It also covers physical and human security channels alongside technical testing.
Yes, OSSTMM is available under a Creative Commons licence from ISECOM. The full methodology manual can be downloaded freely from their website.
The Risk Assessment Value (RAV) is OSSTMM's quantitative scoring system that measures the relationship between operational controls and the attack surface to produce a numerical security score, enabling objective comparison over time.