Castellan Systems' assurance funnel: pentests, red and purple team work, bug bounty and audits pour in at the top and pass through eight stages — assurance map, risk-based scope, testing portfolio, independence, vendors and schemes, findings governance, evidence and attestation, and continuous assurance — so only tested, governed assurance comes out. On the left, the blind spots it closes: an instant-payments rail never tested in eight months, customer authentication tested three times a year, the same pentest firm for six years, a 'CREST-certified' vendor with one certified tester in twelve, and a red team reporting to the people it tested. On the right, one findings register normalizes High, Critical and P2 into one owned severity with an SLA, evidence is gathered once and reused for SOC 2, ISO and PCI, and detections are validated continuously.

CY-SENIOR-055Senior Level · Security Assurance Program

Security Assurance & Testing Strategy — The Assurance Funnel

A strategic senior-level course that builds the org-wide assurance strategy deciding what gets tested, how often, by whom, and how the results are governed - not how to run any single engagement. Work the assurance funnel - eight stages: Assurance Map, Risk-Based Scope, Testing Portfolio, Independence, Vendor & Scheme Selection, Findings Governance, Evidence & Attestation, and Continuous Assurance - mapping every assurance source onto the three-lines model, scoping by risk, building the annual portfolio, protecting independence, choosing vendors and schemes well, governing findings in one register, reusing evidence, and moving to continuous assurance. Four hands-on activities in every lesson, built from real assurance artifacts, not shell commands.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build and maintain an assurance map placing every testing source on the three-lines model, and close the overlaps and blind spots it reveals.
Set risk-based assurance tiers and build an annual testing portfolio that sequences methods to real risk within budget.
Establish independence rules - internal/external boundaries, vendor rotation, conflict-of-interest checks - that satisfy regulator and customer expectations.
Govern one consolidated findings register with normalized severity, SLAs, ownership, and retest evidence, and build the evidence library and metrics for continuous assurance.

Price:৳10,000