OSSTMM Security Testing — Measured Operational Security
OSSTMM is a peer-reviewed methodology for testing operational security. It looks beyond software bugs to how people, buildings, wireless, telecoms and networks can be reached and abused, and measures the result as an attack-surface score.
Mutex Systems uses OSSTMM for broad assessments where physical, wireless and human channels matter as much as the network.
- Category
- Testing Methodology
- Jurisdiction
- International
- Issuing Body
- ISECOM (Institute for Security and Open Methodologies)
- Current Version
- OSSTMM 3
- Who It's For
- Organisations with physical sites, wireless networks, call centres or OT environments that want a measurable view of their whole attack surface.
Core Domains
A Practical Engagement Path
- 01
Define channels
Choose which channels — human, physical, wireless, telecom, data — are in scope.
- 02
Test
Assess visibility, access and trust on each channel.
- 03
Measure
Calculate the attack-surface metrics.
- 04
Report
Findings and a baseline to measure improvement against.
When the network is not the only way in
We combine network testing with wireless, physical and social-engineering tests where the risk calls for it.
- Wireless and physical testing
- Phishing and vishing campaigns
- Repeatable score to show progress
Track the whole attack surface
grComply records findings from every channel, links them to risks and controls, and tracks the security-awareness training that addresses human-channel findings.
- Findings across all channels in one list
- Human-channel findings linked to awareness training and phishing simulations
- Risks and treatment plans in the risk register
- Mapping to ISO 27001 physical, people and technological controls
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About OSSTMM
How is OSSTMM different from PTES?
PTES focuses on running a penetration test end to end; OSSTMM covers a broader set of channels and provides metrics to measure operational security.
Does OSSTMM include social engineering?
Yes, the human security channel covers social engineering, which we run only with written authorisation.
Ready to Start Your OSSTMM Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.