A deployment manager is working with a software development group to assess the security of a new version of the organization's internally developed ERP tool. The organization prefers to not perform…

Static code analysis in the IDE is limited to the development phase and does not assess the security of the deployed and configured product in its runtime environment.

Penetration testing of the UAT environment is a point-in-time assessment conducted only before deployment and does not address ongoing security throughout the full product lifecycle.

Vulnerability scanning can be scheduled and run repeatedly throughout the entire product lifecycle, including in production, supporting a continuous security posture rather than a single event triggered by deployment. Unlike penetration testing, vulnerability scanning is non-destructive and low-risk in production, making it the most practical method for sustained, ongoing assessment across the full lifecycle.

Penetration testing of the production environment is disruptive and high-risk, and it is conducted at a single point in time rather than providing continuous lifecycle coverage.

Peer review prior to unit testing occurs only at the earliest development stage and does not provide security assessment across the broader deployment and operational lifecycle.