Emulating an external attacker without prior knowledge of the application's internal structures and workings
Emulating legitimate users with a range of profiles
Analysis with full access to the application's source codes
Testing with and without the firewall enabled to verify whether potential exploits are blocked