security testing assertion