Manual penetration testing: what a person tests, and how to check you got it
Manual penetration testing is a test where a person decides what to attack, runs the tests and proves each finding, with tools as helpers. It matters most for business logic, which OWASP says a vulnerability scanner cannot detect. Many reports sold as manual are scans with a cover page, so ask for the test cases, per-role evidence and the list of what was not tested before you accept the label.
Manual penetration testing is a security test in which a person decides what to attack, runs the tests and proves each finding, using tools as helpers. It matters most for flaws in business logic, which the OWASP testing guide says "cannot be detected by a vulnerability scanner".
Most explanations stop at that definition. This page lists the tests that need a person, and gives eight questions to check that the test you are paying for was manual.
What does a manual tester do that a scanner does not?#
A scanner sends known patterns and reads the responses. A person reads the app first, works out what it is meant to do, and then tries to make it do something else.
The OWASP Web Security Testing Guide (WSTG) v4.2 says this most directly about business logic. It states that "automation of business logic abuse cases is not possible and remains a manual art", and that tools "have no means of detecting if a user is able to circumvent the business process flow". That text dates from the v4.2 release. AI agents now attempt some of these tests, which we cover below.
Which tests need a person?#
WSTG section 4.10 lists nine business logic tests. This table gives each one, an example of what a person checks, and why a scanner misses it.
WSTG v4.2 business logic tests, with the human judgment each needs
| WSTG 4.10 test | Example a tester tries | Why a scanner misses it |
|---|---|---|
| 4.10.1 Business logic data validation | A refund for a negative amount, or a discount above 100% | The value is valid in format; only the business rule makes it wrong |
| 4.10.2 Ability to forge requests | Sending a hidden "price" or "role" field the form never shows | The scanner does not know which fields the user should control |
| 4.10.3 Integrity checks | Changing a record that should be read-only after approval | "Should be read-only" is a rule, not a response pattern |
| 4.10.4 Process timing | Cancelling an order after it ships but before stock updates | The flaw needs a sequence and a time window |
| 4.10.5 Function use limits | Redeeming a one-time coupon twice | The scanner does not know the limit is one |
| 4.10.6 Circumventing workflows | Calling the "confirm" step without the "pay" step | It needs a model of the intended order of steps |
| 4.10.7 Defenses against application misuse | Checking that repeated invalid actions trigger any response | It needs a judgment on what the app should notice |
| 4.10.8 Upload of unexpected file types | A file type the feature should never accept | Allowed types depend on the feature's purpose |
| 4.10.9 Upload of malicious files | A test file that a malware check should catch, to see whether anything blocks it | The tester judges what the stored file could do and who opens it later |
Authorization testing sits close to this list. An insecure direct object reference (WSTG-ATHZ-04) is only a flaw if the second user should not see the record. Someone has to know the rule.
How do you check that a test was manual?#
Ask these eight questions in the vendor call, and again when the report arrives. A test that was mostly a scan will struggle with most of them.
- Who tested, and for how long? Ask for the days or hours of human testing in the proposal.
- Which business rules did you test? A manual tester will name your workflows: invites, refunds, approvals, exports.
- Which roles did you test with? Expect a test account per role and evidence from at least two of them for authorization findings.
- Can I see a finding's full evidence? Expect the request, the response and a read-back that shows the effect, with timestamps.
- What did you try that failed? A person keeps notes on controls that held. A scan only lists hits.
- What did you not test, and why? Look for a limitations section that names areas and reasons.
- Which findings came from a tool, and how did you confirm them? Unconfirmed scanner output should be labeled or removed.
- Will the same person retest the fixes? The retest should repeat the original proof.
The 12-row report scorecard turns these into a score you can apply to any report, manual or AI-assisted. To see what per-finding evidence looks like, read the sample report on excessionlabs.ai, the main site of Excession Labs, which also runs this site.
What are the limits of manual testing?#
A person is slow at breadth. Checking every route against every role, or repeating a test after each release, takes days of attention, and people skip steps when work is repetitive.
A manual test is also a snapshot. It covers the app as it was during the test window, and a release the next week can add new flaws. The tester's skill sets the result, so two manual tests of the same app can find different things.
Where do AI agents fit next to manual testing?#
AI agents are good at the repetitive part: every route, every role, the same check after each release. They are weak where the table above needs judgment about what the business intends.
We sell AI-assisted testing, not manual testing. Our AI testing agents run the wide, repeatable work under written scope and tool rules. Excession Labs agrees the scope, including the business rules you name, checks the evidence for each finding and writes the report. The AI vs manual pentesting page splits the work task by task, and where AI pentesting falls short lists the cases where you should hire a manual specialist instead.
Questions about the agents
Is manual penetration testing better than automated?
For business logic and multi-step abuse, a person usually finds more, because the flaw depends on what the app is meant to do. For breadth and repetition, tools are faster. Most good tests mix both. Judge a test by its evidence and coverage, not by the label.
Do compliance standards require manual testing?
Wording differs by standard, and most do not say manual. Read the text of the standard that applies to you, and ask your auditor what they expect before you scope the test. A report alone does not make you compliant.
How long does a manual pentest take?
It depends on scope: the number of roles, features and API routes, and whether you need a retest. Ask each provider to state the days or hours of human testing in the proposal, so you can compare like with like.
Sources
- OWASP Web Security Testing Guide v4.2: Introduction to business logic (checked 11 November 2026)
- OWASP Web Security Testing Guide v4.2: Business logic testing (section 4.10) (checked 11 November 2026)
- OWASP WSTG-ATHZ-04: Testing for insecure direct object references (checked 11 November 2026)