“The testing guide is how to validate the security.”

Transcript evidence from Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood.