Difference between compliance testing and security testing?

• A. Compliance testing verifies adherence to standards/regulations; security testing focuses on identifying vulnerabilities
• B. Compliance testing is the same as security testing
• C. Security testing checks only for compliance
• D. Security testing replaces patch management

Answer: (A)

Compliance testing checks that systems and processes meet required standards and regulations, gathering evidence that controls are in place and functioning as specified. Security testing, by contrast, actively probes the system to uncover weaknesses that could be exploited—vulnerabilities, misconfigurations, and insecure designs. The emphasis is different: compliance testing demonstrates conformance and accountability, while security testing evaluates how well the system stands up to real threats.

They often complement each other, but one does not replace the other. A system can meet regulatory checklists yet still have exploitable vulnerabilities; conversely, security testing may reveal issues that don’t explicitly map to a regulatory requirement but still raise risk.

Why the other ideas don’t fit: security testing isn’t about only checking regulatory compliance, and compliance testing isn’t about finding exploitable weaknesses—though there can be overlap. And security testing does not substitute for patch management, which is the ongoing process of applying fixes; testing helps identify what needs patching, but it doesn’t perform patching itself.