Security · Application testingOctober 18, 20264 min · updated October 18, 2026

AWS reports 33 of 37 security-test successes: what evidence to ask for

Daillac research

AWS — Security Agent benchmark, October 15, 2026

Written by

Editorial team and software engineering

Staged laboratory bench with laptops separated by transparent partitions to illustrate isolated security tests

AWS has published new results from automated penetration tests. If your business is preparing an assessment, ask how the supplier will check the permissions and business rules of your own application.

Read the result with the counting rules

The AWS report, published October 15, records 33 validated successes across 37 challenges. Two other captures were reclassified; two attempts failed after the target became unavailable. The result applies to these controlled challenges, not every customer application.

Ask what the assessment will actually cover

For a Montreal business preparing an audit, start with the applications and access levels that matter. A public website, an employee portal and a partner API expose different paths. A supplier should state which environment will be assessed and which accounts will be used. Obtain the required authorization and agree operating limits before testing a real system.

TableQuestions to put in the assessment brief · shareable block

Questions to put in the assessment brief
	Evidence to request	Why it changes the decision
Assessment scope	Applications, endpoints, roles, exclusions and test environment.	A clean result only applies to work actually covered.
Confirmed finding	Reproducible evidence and the affected version.	The team needs enough information to understand and fix the issue.
Operational limits	Permitted actions, stop conditions and emergency contact.	Testing must fit the organization’s operating constraints.
Correction	Owner, agreed priority and retest result.	An initial finding remains open until its treatment is checked.

Consider a fictitious client portal where each account should see only its own documents. A general benchmark score cannot answer whether that boundary holds for the portal. A useful assessment attempts the agreed cross-account scenario with synthetic files and records the observed access decision. The business consequence belongs in the finding so the development team can prioritize it.

What changes when testing joins the deployment pipeline

In a separate October 14 article, AWS describes a pattern that deploys to staging, runs a test scoped to the code change and controls promotion to production. That pattern supports more frequent checks. Its value depends on the scope decision, the selected threshold and how the team handles a run that did not test the intended change.

TableProposed treatment of a release check · shareable block

Proposed treatment of a release check
	What the team should inspect	Next step
Test performed, relevant finding	Affected journey, evidence and severity policy.	Assign correction and verify it before the agreed release decision.
Test passed for the configured scope	What changed and what the test covered.	Keep other required business and operating checks.
No applicable test or scope conflict	Why coverage was absent.	Resolve the gap or record an authorized decision; do not label it tested.

Keep business acceptance alongside the security review

A security assessment may find unauthorized access while a business review finds a legitimate employee cannot complete a delivery. Both affect launch. The same test environment can support those reviews, but each needs its own expected outcome and owner. Our business acceptance guide gives examples of journeys and recovery checks.

We would begin a small assessment by documenting one important application, its roles and the operational boundaries. The deliverable should show the assessed scope, the evidence for each finding and what happened after correction. That gives a business owner something to discuss with the team beyond a single score.

Questions fréquentes

Does a benchmark percentage apply to our application?+

No. It applies to the chosen test set and its validation rules.

Can a successful test replace business acceptance?+

No. Verify the security requirements and the legitimate journeys that employees and customers need to complete.

Can testing be run directly on production?+

Only within the authorization and operating limits agreed for that environment. A staging plan may be more appropriate for a particular scope.

What should follow a confirmed finding?+

Assign an owner, prioritize the correction and retest the affected behaviour on the relevant application version.

Define the evidence for your application review

Bring the application list, roles and important business journeys. We can help scope an assessment and a follow-up record.

Discuss your project Explore the service

Sources & method

Primary-source review dated October 17, 2026. Vendor statements are attributed; practical recommendations and hypothetical examples are Daillac editorial analysis.

News feed

October 18, 2026

Security · Automation