Security testing reports are the most likely deliverables to contain detailed records of evaluations, their frequency, and re-evaluations. Here's why:
* Purpose of Security Testing Reports: These reports document the results of security testing, including:
* Types of tests: Vulnerability scans, penetration tests, code reviews, etc.
* Frequency: How often tests were conducted (e.g., per build, per release cycle).
* Re-evaluations: If vulnerabilities were discovered, these reports will track whether and how often those were retested after remediation.
* Focus on Testing: The question specifically emphasizes evaluations, which aligns with the core content of security testing reports.

A threat profile is a security assessment deliverable that identifies possible security vulnerabilities in a product. It involves a systematic examination of the product to uncover any weaknesses that could potentially be exploited by threats. The process typically includes identifying the assets that need protection, assessing the threats to those assets, and evaluating the vulnerabilities that could be exploited by those threats. This deliverable is crucial for understanding the security posture of a product and for prioritizing remediation efforts.
References: The importance of a threat profile in identifying security vulnerabilities is supported by various security resources. For instance, Future Processing's blog on vulnerability assessments outlines the steps involved in identifying security vulnerabilities, which align with the creation of a threat profile1. Additionally, UpGuard's article on conducting vulnerability assessments further emphasizes the role of identifying vulnerabilities as part of the security assessment process2.

The security testing technique that involves using a testing tool to scan a running application for known exploit signatures is known as Automated Vulnerability Scanning. This method is part of dynamic analysis, which assesses the software in its running state to identify vulnerabilities that could be exploited by attackers. Automated vulnerability scanning tools are designed to detect and report known vulnerabilities bycomparing the behavior and outputs of the application against a database of known exploit signatures1.
References: 1: Application Security Testing: Tools, Types and Best Practices | GitHub