Security Acts: The Magazine for IT Security
Security Acts was the sister title of Testing Experience: a magazine for IT security launched by the same Berlin publisher in late 2009, after the June 2009 security testing issue. It carried forward a bridge between software testing and security testing that is still worth crossing.
Archive featureUpdated
Browse all 28 issues
Every issue with its date and theme, and the twelve that have their own page.
Open the issue indexHow Security Acts began
The publisher of Testing Experience launched Security Acts, subtitled the magazine for IT security, in late 2009. The timing was not an accident. The June 2009 issue of Testing Experience, issue 6, had been devoted to security testing and included an article on the OSSTMM, the open source security testing methodology. That issue showed there was an audience for security material written for practitioners, and the publisher gave it a title of its own.
One editorial operation, two audiences, each magazine promoting the other.
What is known
Little is known about Security Acts in detail. Issues 3 and 4 are known to have existed, which places the title at least a year into publication. In 2010 it served as media partner at an international incident-response conference, the same role Testing Experience played at testing events such as the Eclipse Testing Day. That confirms the publisher's approach: one editorial operation, two audiences, each magazine promoting the other.
How many issues Security Acts ran to, and when it stopped, is not covered here, and this site makes no claim about the title's later history. The original issues are not distributed here.
What it stood for
What Security Acts stood for is clearer than its publication history: the editorial bridge between software testing and security testing that began with the OSSTMM article in issue 6. Testers and security specialists in 2009 worked in separate departments, read separate publications and went to separate conferences. A magazine that asked functional testers to think in terms of attack surfaces and trust, and asked security people to think in terms of test design and coverage, was doing something unusual.
Why the bridge is worth keeping
Security testing is still the area where most test teams have the least confidence and the most exposure, and the methodology-first approach the OSSTMM article introduced to testers in 2009 remains the right one. The security testing guide on this site covers the five main types of security testing, the OSSTMM and the OWASP Top Ten as vocabularies, where each activity sits in a delivery pipeline, and what a tester without a security background can start doing this quarter.
How security testing practice changed, 2009 to 2026
When issue 6 and then Security Acts appeared, OSSTMM 2.x was the current methodology; OSSTMM 3 arrived in 2010 with the rav as a reproducible attack-surface measure. The OWASP Testing Guide was at version 3, from 2008; version 4 followed in 2014 and the Web Security Testing Guide 4.2 in 2020, with numbered test cases that a pipeline can reference. NIST SP 800-115, published in September 2008, is still the assessment guide that regulated buyers in the United States cite.
The practical change is cadence: a 2009 security test was an engagement booked once a year, and the magazine's role was to explain it to testers who would never run one. In 2026 the cheap activities (threat modelling at design, static analysis and dependency scanning on every commit, dynamic scanning in staging) run continuously, and the penetration test is the last check rather than the only one.
Where an IT security reader should go now
Start with Table 1 of the security testing guide, which compares the five types of security testing by lifecycle stage, what each finds and misses and who runs it, then the section 'OSSTMM in plain terms' for the channels, the visible-accessible-trusted distinction and the rav. The section on where security testing sits in a delivery pipeline, with its pipeline budget callout, is the one to hand to a delivery lead. A reader from the testing side should read the closing five-point list, which begins with adding abuse cases to every story.
For the risk vocabulary the OWASP Top Ten section covers, pair it with the risk-based testing guide's scoring matrix so that security risks are scored on the same 5 by 5 scale as everything else. For mobile applications the mobile app testing guide's permissions section and the OWASP MASVS it cites are the starting points. The issue 6 page describes the security testing issue that started the bridge.
At a glance
Questions
What was Security Acts?
The IT security sister magazine of Testing Experience, from the same Berlin publisher, launched in late 2009 after the June 2009 security testing issue. It described itself as the magazine for IT security.
Are Security Acts issues available here?
No. This site does not distribute the original issues of Security Acts or of Testing Experience.
Is Security Acts still published?
That is not covered here. Issues 3 and 4 are known to have existed, and the title is not part of this site.
How was Security Acts connected to Testing Experience?
Same publisher, same editorial approach. It grew out of the June 2009 security testing issue, and the two titles promoted each other at testing and security events.
Where is security testing covered on this site?
In the Testing Techniques hub: the security testing guide covers the main types of security testing, the OSSTMM and OWASP vocabularies, and where each activity fits in a delivery pipeline.
