Human judgement, AI speed.
Aveas Fundamentals
Continuous Penetration Testing Essentials
The foundations of modern application security testing: how attackers approach a SaaS product, how continuous AI-assisted testing and human verification work together, and how to read, score and act on a penetration test finding.
About this certification
Aveas Fundamentals is the entry point to the Aveas security certification track. It teaches how real attacks on web applications and APIs begin, which classes of weakness matter most, and how a modern penetration testing program finds them: automated testing for breadth on every release, and experienced testers who confirm what is actually exploitable.
It is written for the people on both sides of a finding. Engineers learn to read one and fix it; compliance teams learn what good testing evidence looks like and what an auditor will ask for.
Who it is for
- Security engineers moving into offensive testing
- Developers and QA engineers who receive and fix findings
- GRC and compliance analysts who rely on pentest evidence
- Engineering managers at SaaS, fintech and healthtech companies
What you will be able to do
- Map the attack surface of a modern web application and its APIs
- Recognize the OWASP Top 10 and OWASP API Security Top 10 risk categories in a real finding
- Score a finding's severity consistently with CVSS and explain its business impact
- Explain what automated testing finds well, where it produces false positives, and why a person verifies exploitability
- Read a finding's evidence, reproduction steps and remediation, and turn it into a well-formed ticket
- Define scope and rules of engagement that keep testing authorized and safe
Course outline
8 modules · 25 topics · outline may be refined before launch
1How attackers see a SaaS product3 topics
Attack surface, trust boundaries and how most breaches start.
- Attack surface: web, APIs, mobile back ends and third-party integrations
- Trust boundaries and where they fail
- How real breaches begin: stolen passwords, misconfiguration and exposed APIs
2Web application vulnerabilities4 topics
The OWASP Top 10, with an example of each.
- Broken access control and insecure design
- Injection and cross-site scripting
- Security misconfiguration and vulnerable components
- Server-side request forgery
3API security3 topics
The OWASP API Security Top 10 in practice.
- Broken object-level and function-level authorization
- Excessive data exposure and mass assignment
- Rate limiting and resource consumption
4Authentication and sessions3 topics
How identity is proven, kept and abused.
- Passwords, multi-factor and single sign-on
- Session tokens, cookies and JWTs
- Account recovery and enumeration
5Continuous testing: AI breadth, human depth3 topics
Why testing runs on every release, and who decides what is real.
- Point-in-time pentests versus continuous testing
- What automated and AI-assisted testing covers well
- False positives, and how a tester proves exploitability
6Reading and scoring findings3 topics
Turn a finding into a decision.
- Anatomy of a finding: evidence, reproduction, impact, remediation
- Severity with CVSS, adjusted for business context
- Writing a ticket a developer can act on in Jira or GitHub
7Scope, authorization and ethics3 topics
Testing that is legal, safe and agreed in writing.
- Written authorization and rules of engagement
- Testing safely around production systems and customer data
- Responsible disclosure
8Testing evidence for compliance3 topics
What auditors ask about penetration testing.
- Where pentesting appears in SOC 2, ISO 27001, HIPAA and PCI DSS
- What makes evidence audit-ready
- Retests and closing the loop
The exam
Planned format. The final details are published when the certification opens.
- Format
- Online, multiple-choice and scenario-based questions
- Scenarios
- Read real-style findings and evidence; choose the severity, the fix and the next step
- Attempts
- Fresh questions drawn from a larger pool on every attempt
- Details
- Question count, time limit and pass mark are published when the certification opens
Prerequisites
None. Comfort with how websites and APIs work (HTTP, browsers, logins) is assumed; no security background is required.
Certificate and badge
an authorized certificate authority, verified on VeraGen LearnA certificate issued by Aveas, with a unique ID and QR code that anyone can check on the Verify page, and an Aveas Fundamentals digital badge for LinkedIn and email signatures.
Get notified when it opens
Aveas Fundamentals opens in 2027. Leave your email and we will tell you when enrollment opens.