Automatic test-evaluation Required Reliable mapping between alert and testcode Approach One single vulnerability (or FP) per testcase Every testcase is hosted in an application of its own The rest of the application should otherwise be clean Benefits Clear relation between alerts and testcases Alert => the case was found / the FP triggerd No alert => the case was missed
{}