beSTORM

beSTORM is a dynamic application security testing and fuzzing tool from Beyond Security, a company now part of Fortra. It addresses the risk that software and connected devices contain unknown vulnerabilities which conventional scanning or code review may not uncover, particularly when source code is unavailable, as with third-party components or embedded hardware. beSTORM’s approach is black-box fuzz testing: it systematically sends large volumes of malformed, unexpected and boundary-case inputs to a target through its network protocols and interfaces, monitoring for crashes, hangs or abnormal behaviour that could indicate exploitable flaws. By testing the running product rather than its code, it allows vendors and buyers to certify software or hardware before release or deployment and to discover zero-day issues early.

Key features include support for a large number of network protocols and file formats, custom protocol modelling for proprietary interfaces, and intelligent test generation that prioritises the most likely attack vectors while allowing exhaustive testing where time permits. Monitoring modules detect crashes and anomalies on the target, and detailed reports help developers reproduce and fix issues. beSTORM can test a wide range of targets, including network devices, web servers, industrial control systems, medical devices, automotive components, Internet of Things products and embedded systems. It supports testing against security certification requirements and standards used in various industries and can be incorporated into development and quality assurance processes to test each build. The product is typically installed on-premises, giving organisations control over sensitive test environments. It is used by software and hardware manufacturers, device makers, telecommunications providers, defence and government organisations, financial institutions and security testing laboratories. Its focus on binary, protocol-level testing makes it particularly relevant where source code access is limited. Pricing starts from around USD 50,000, likely as an annual licence, with a free trial; there is no free version.