Methodologies and techniques

Technique

A technique is one thing you test for, with an objective, a procedure, the evidence it expects, a statement of secure behaviour, and remediation guidance. Techniques are global to the installation: they live in a catalogue shared across engagements, not copied into each one. Each technique carries mappings to external standards (OWASP WSTG, OWASP ASVS, MITRE CWE), and those mappings are what let a finding inherit CWE codes and, through the compliance crosswalk, related control frameworks. A technique that carries no mapping contributes nothing to compliance, which is a signal worth seeing.

Methodology

A methodology is an ordered set of steps, and each step links a set of techniques in position order. It is the plan of what to test and in what sequence. An engagement adopts one or more methodology frameworks, and the cockpit renders their steps and techniques in that execution order.

Coverage

Coverage is the record of what you actually tested. For each technique against each asset, coverage carries a status: not_tested, tested_no_finding, tested_with_finding, or not_applicable. Marking something not_tested or not_applicable other than by default requires a reason, so a gap in coverage is always explained rather than silent. Coverage is what the cockpit drives and what the engagement's progress is measured against.

Why techniques are the hinge

Because techniques carry the mappings, and coverage and findings are recorded against them, the technique is the hinge between execution and reporting. Working a technique produces coverage; a finding links to techniques; the links carry the mappings; the mappings drive the compliance controls in the report. Get the technique links right and the rest derives itself.