An organization was preparing to harden an environment before granting access to external auditors. Vulnerability testing was completed, and only one low-priority, informational vulnerability remained

Functionality testing verifies that application features work as designed from a user perspective and does not actively probe whether security controls like authentication can be bypassed.

Usability testing evaluates the interface and user experience, not whether authentication mechanisms are properly enforced.

Regression testing checks whether recent code changes broke existing behavior and does not involve attempting to circumvent security controls.

Penetration testing involves actively attempting to exploit vulnerabilities, including trying to access protected pages without valid credentials. A penetration tester would have directly navigated to the login page on a clean browser and found that no credentials were required, exposing the authentication bypass. Automated vulnerability scanning rated the finding as low/informational, so only hands-on exploitation testing would have revealed the true severity.