Which of the following methods is used by internal security teams to assess the security of internally developed applications?