As there are various kinds of security testing tools, it may be time-consuming to analyze the testing results generated by every testing tool. When simply reading the security testing results, it may be hard to tell what security testing cases are executed. For example, the security testing reports generated by NMAP can be understood by the security testing team, but may not be easily understood by the DevOps team. Those are the issues that the BDD security framework can solve. The purpose of the adoption of the BDD security framework is to integrate all security testing tools and to define all the security testing cases by using human-readable user-story statements.
To build the whole automation framework, it's suggested that you have the security testing tools in place first, such as NMAP, SSLyze, SQLmap, ZAP, and Arachni. Don't try to build...
