NIST SP 800-115 is a technical guide to planning and running information security tests and assessments. It says scanners find known vulnerabilities but have high false positive rates, penetration tests exploit weaknesses to confirm them, and a program of regular scanning with periodic pen tests works better than either alone.
The basics
Published in September 2008 and still listed as final, it replaced SP 800-42. It is an overview of key elements, not a complete testing program. It focuses on specific technical techniques, their strengths and weaknesses, and when to use them. Its age matters: the techniques are sound, but specifics such as cloud and modern application stacks are outside its scope.
What it says, in plain words
- Scanning. Vulnerability scanning identifies hosts, open ports and known vulnerabilities, often with advice on mitigation. The guide flags high false positive rates and says results need interpretation by someone with network and operating system expertise.
- Validation. Findings often need validating to isolate false positives. A second automated tool may reproduce the same false positives, while manual examination is usually more accurate and slower.
- Penetration testing. It has four phases: planning, discovery and attack, with reporting alongside. Unlike scanners, which check for the possible existence of a vulnerability, the attack phase exploits it to confirm.
- Viewpoint. Testing can be external or internal, and overt or covert. If both external and internal are done, external usually goes first.
- Risk. Penetration testing uses real exploits against real systems, so an incident response plan should be in place, and testers may stop where further action would cause damage.
- Cadence. Because of cost and potential impact, annual penetration testing may be sufficient, and less labor intensive testing should run regularly. The guide describes regular network and vulnerability scanning, interspersed with periodic penetration testing, as a way to prevent many attacks and reduce impact.
How to use it today
| Need | Takeaway from the guide |
|---|---|
| Write a test plan | Set rules, approvals and goals before any testing |
| Choose a viewpoint | Start external, then internal |
| Handle scanner output | Validate it, do not just accept scanner risk levels |
| Set cadence | Frequent scans, periodic pen tests |
| Reduce risk of testing | Have incident response ready, agree stop conditions |
Limits to keep in mind
- It predates containers, serverless, SaaS APIs and package ecosystems as attack paths.
- It says little about software dependencies. Use current guidance for supply chain risk.
- It is guidance, not a requirement for any specific organization.
Quick check
Is NIST SP 800-115 still current?
NIST lists it as final, dated September 2008. The principles hold, but treat the technology specifics as dated.
Does it require annual pen tests?
No. It says annual testing may be sufficient given cost and impact, and leaves the decision to the organization.
Safeguard handles the frequent, automated end of that cadence, with SBOM and dependency scanning and reachability analysis. You can try a free scan.
Sources
Last reviewed: 19 October 2026.
