Vulnerability testing typically is not outsourced.

• A. True
• B. False
• C. Sometimes
• D. Not sure

Answer: (B)

Vulnerability testing is commonly outsourced because external security specialists bring specialized tools, a breadth of experience across many environments, and objective assessments that in-house teams may struggle to match. Outsourcing provides independent validation, faster scalability for periodic or after-change testing, and access to up-to-date attack techniques and methodologies. While some organizations do conduct testing internally or mix approaches, the general pattern in many industries is to rely on third-party testers for at least part of the vulnerability assessment process. Therefore, the statement that vulnerability testing typically is not outsourced is not accurate.