Skip to content

Fuzzing

What is Fuzzing?

An automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. Fuzzing aims to discover coding errors and security vulnerabilities.

Information Security

Frameworks that govern fuzzing

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on fuzzing

Requirements naming fuzzing across 3 standards, quoted from the control text.

OpenSSF Scorecard1 control

Operate static analysis + fuzzing + testing per OpenSSF Scorecard checks SAST + Fuzzing + CI-Tests. Static Analysis SAST must (a) run SAST on every PR + (b) detect common security vulnerabilities (injection + authentication + authorisation + crypto + secrets +...

OSSFSC-5 · Static Analysis, Fuzzing, Testing Coverage →
O-RAN WG11 Security Specification1 control

Operate security test + certification + conformance per O-RAN WG11 Security Test Specifications and WG11 Test Specifications including Open Test and Integration Center (OTIC) testing.

ORANWG11-6 · Security Test Specifications, Certification, and Conformance →
PTES1 control

Both passive techniques such as traffic monitoring and active techniques such as fuzzing and probing must be used to expose flaws in design, configuration, and implementation.

PTES-VA-2 · Active and Passive Testing →

Questions people ask about fuzzing

What is Fuzzing?
An automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. Fuzzing aims to discover coding errors and security vulnerabilities.
Why is Fuzzing important for compliance?
Fuzzing is a key concept in Information Security. Understanding fuzzing helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Fuzzing?
Fuzzing appears in the requirement text of OpenSSF Scorecard, O-RAN WG11 Security Specification, PTES. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Fuzzing?
Explore our compliance framework pages to see how fuzzing applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Fuzzing applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.