More coverage means more confidence
The scope of an injection attack detection test programme determines the range of threats it evaluates a system against. Understanding the variables – the number of attack methods, the diversity of instruments, and the level of testing required – it is the starting point for any meaningful conversation about cost and coverage.
What a test programme actually consists of
IAD testing scope is determined by two primary variables:
Injection Attack Methods (IAMs) IAMs are the mechanisms through which data is delivered into the system – virtual cameras, function hooking, OS-level exploits, network interception, and others. The number and variety of IAMs included in a test programme determines the range of delivery mechanisms the system is evaluated against.
Injection Attack Instruments (IAIs) IAIs are the data payloads themselves – deepfake biometric sequences, replayed video streams, AI-generated identity documents, and others. The number and diversity of IAI species determines how thoroughly a system’s detection capabilities are exercised.
Scope also includes the number of operating environments, devices, and platforms tested. A system that performs well against injection attacks on one platform may not perform equally well across all environments in which it is deployed.
The combination of these variables determines both the coverage of a test programme and its cost.
The five levels of IAD testing
From compliance baseline to advanced assurance
Ingenium’s IAD programme is structured in five levels. Each level builds on the last, expanding the number and complexity of IAMs and IAIs to provide progressively more comprehensive coverage.
Level 1 – CEN/TS 18099 Substantial
The foundational compliance tier. Aligned with the CEN/TS 18099 ‘Substantial’ evaluation level, Level 1 tests against 2 or more IAMs and 10 or more IAI species. A well-structured starting point for organisations at the beginning of their IAD testing programme, or where CEN/TS 18099 Substantial compliance is the primary requirement.
Effort: 25 FTE days
Level 2 – CEN/TS 18099 High
Aligned with the CEN/TS 18099 ‘High’ evaluation level. Expands IAM coverage to 3 or more methods and increases the attack weighting, providing a more rigorous evaluation of system resilience against a broader range of delivery mechanisms.
Effort: 30 FTE days
Level 3 – Beyond the standard
Exceeds the CEN/TS 18099 requirements, with greater emphasis on sophisticated IAMs and a more diverse set of IAI species. Designed for organisations that require testing to go beyond the compliance threshold and reflect a more realistic threat picture.
Effort: 35 FTE days
Level 4 – Extended IAI focus
A 40 FTE-day programme that maintains high attack weighting while specifically targeting a system’s IAI detection capabilities. This level also provides valuable insight into PAD subsystem resilience as a secondary output – not a formal PAD assessment, but a meaningful supplementary perspective on system behaviour.
Effort: 40 FTE days
Level 5 – Maximum coverage
Ingenium’s most comprehensive IAD evaluation. Level 5 includes the highest volume of IAI species – including instruments specifically created by Ingenium’s team to target the unique functionality of the system under test. Designed for systems that operate in high-risk environments or where the highest available level of assurance is required.
Effort: 50 FTE days
Lower coverage is not just cheaper. It is a different level of protection.
Testing cost is a function of coverage. A test programme covering fewer IAMs and IAI species costs less and provides evidence of resilience against fewer threat scenarios.
That is a legitimate choice in the right context. For a system operating in a low-risk environment, with limited exposure, and where CEN/TS 18099 Substantial compliance is the stated requirement, Level 1 testing may be entirely appropriate.
For a system processing sensitive financial data, operating across multiple platforms in a high-threat environment, or facing well-resourced adversaries, the same level of testing may leave material gaps in assurance coverage. Those gaps are not visible in a compliance report. They may be visible to an attacker.
The question to ask is not: what is the minimum level of testing required? The question is: what level of testing is appropriate for the risk profile of this system?
The factors that shape pricing in practice
Beyond the five-level framework, the following factors influence the scope and cost of a specific IAD engagement:
- Number of platforms and operating environments: desktop, mobile, web browser, specific hardware configurations
- Number of devices per platform: each additional device adds transactions and analysis time
- System complexity: highly customised or multi-layered systems may require additional scoping and environment setup
- Client access requirements: remote access vs. on-site engagement; data handling and security protocols
- Reporting requirements: standard structured reporting vs. bespoke formats for specific regulatory submissions or procurement contexts
- Engagement timeline: compressed delivery schedules may carry a resource premium
Get a clearer picture before committing to a full scope
Before committing to a full scoping conversation, many organisations find it useful to build a preliminary sense of the testing parameters relevant to their situation. An initial conversation will provide an indicative view of scope and effort based on your platform count, risk level, and compliance requirements.
The question isn’t whether to test. It’s how thoroughly.
Understanding the right level of testing for your systems starts with a conversation. Our team will help you identify the appropriate scope for your risk profile, regulatory context, and budget – without steering you towards more testing than your situation requires.