Free tools Windows power users keep installed
One-click scans. No signup required.
Microservices change security testing by moving important security boundaries from one application into a network of independently deployed services. Testing only each service’s source code can miss risks in service identity, authorization, communication, data flows, deployment configuration, and runtime behavior. A sound plan inventories those boundaries and tests the controls that protect them in the context of the system’s actual architecture.
Why microservices change the security test scope
In a microservices system, services communicate through APIs and other infrastructure, often across independently managed deployment boundaries. Security therefore depends not only on what each service does with its own inputs, but also on which callers it trusts, what downstream permissions it holds, how data moves between services and stores, and how the system behaves when components fail or change.
NIST identifies authentication and access management, service discovery, secure protocols, monitoring, resilience, load balancing, throttling, service induction integrity, and session persistence as security-related considerations for microservice interactions. These concerns do not mean that microservices are inherently less secure. They mean the system’s distributed boundaries and operational controls belong in the test plan alongside application code. NIST SP 800-204
Build an inventory before choosing tests
Start with an architecture view broad enough to capture internal paths, not merely routes exposed to the public internet. OWASP recommends documenting application-functionality services and their API definitions, infrastructure services, data assets, service-to-storage relationships, and synchronous and asynchronous communications. This inventory helps identify attack surfaces, support threat modeling, and trace where sensitive data can move. OWASP Microservices based Security Arch Doc Cheat Sheet
#1 Best Overall
Inventory the paths and assets
- List services, their responsibilities, API definitions, and endpoints, including internal interfaces.
- Record infrastructure services such as message brokers, service discovery, and other components that services depend on.
- Map sensitive data assets to the services that read, write, transform, or transmit them, including databases and queues.
- Mark whether interactions are synchronous or asynchronous, and note the relevant identity and trust boundaries.
- Include deployment and operational components that can alter access or communication, such as gateways, service meshes, and infrastructure configuration.
Use the map to ask concrete least-privilege questions: “What scopes or API keys does microservice minimally need to access other microservice APIs?” and “What grants does microservice minimally need to access database or message queue?” OWASP also prompts teams to ask which microservice endpoints need to be tested during security testing. Those questions are useful scoping prompts, not a substitute for examining the application’s own threat model.
Test identity and authorization at every relevant boundary
For each service interaction, establish who the caller is, how that identity is conveyed, and what the receiving service permits. NIST includes authentication and access management among the core concerns for API-based interactions. OWASP discusses edge-level authorization as well as service-to-service authentication, while noting that relying on authorization at the edge is a fit for simple scenarios rather than a universal pattern. OWASP Microservices Security Cheat Sheet
Rank #2
Check edge and internal access
- Verify that public-facing authorization rules enforce the intended access limits.
- Determine whether internal services can be reached directly in a way that bypasses the API gateway, and test whether those paths enforce the required controls themselves.
- Check how services authenticate one another and how credentials, tokens, or keys are handled across calls.
- Test whether a caller can obtain only the permissions needed for downstream APIs, databases, and message queues.
- Confirm which component enforces each policy. A policy configured at a gateway or another shared layer should not be assumed to protect a path that does not pass through that layer.
Test both permitted and denied actions at the relevant boundaries. The objective is to establish that identity and authorization remain effective along the actual call path, including the service-to-storage relationship—not simply that a gateway rejects an unauthorized external request.
Cover communication, discovery, resilience, and monitoring
Service instances and routes may change with deployment patterns and runtime conditions. NIST SP 800-204 and SP 800-204A address secure communication, service discovery, key management and encryption, availability and resilience, throttling, and monitoring. The applicable checks depend on how the system discovers services, establishes trust, and handles load and failures. NIST SP 800-204A
Match tests to the deployment pattern
- Review whether service-to-service traffic uses the intended secure protocols and whether keys or other credentials are managed appropriately.
- Test discovery and routing assumptions against the system’s actual deployment model, including changes in service instances where relevant.
- Assess throttling and resilience controls for the interactions where overload or dependency failure could affect security or availability.
- Check that monitoring provides useful visibility into relevant interactions and failures without exposing sensitive data unnecessarily.
A service mesh can provide a shared place to configure some proxy-based capabilities, but the mesh configuration and resulting service policies still need assessment and testing. NIST SP 800-204A describes deployment guidance for proxy-based service-mesh components; it does not establish that any particular mesh deployment is correctly secured. A gateway or mesh changes where some controls may be implemented, not whether the controls require verification.
Include application, infrastructure, and policy code in assurance
Security testing should account for the code and configuration that shape the deployed system. NIST SP 800-204C describes five code types in a microservices DevSecOps environment: application code, application-services code, infrastructure as code, policy as code, and observability as code. It identifies static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA) as examples of security-testing tools, and notes that infrastructure as code can be assessed for security design gaps. NIST SP 800-204C
Rank #4
| What is under review | Relevant assurance focus |
|---|---|
| Application code | Use suitable code-focused security analysis, such as SAST, alongside checks of service behavior and authorization boundaries. |
| Application-services code and APIs | Assess service interaction behavior, identity, access rules, and relevant dynamic behavior in the deployed context. |
| Infrastructure as code | Review configuration for security design gaps and for unintended exposure or access paths. |
| Policy as code | Verify that the written policies express the intended access and security controls and apply at the paths they are meant to protect. |
| Observability as code | Check that configured monitoring supports visibility into security-relevant interactions while handling sensitive information appropriately. |
| Dependencies | Use SCA to assess software components and their dependencies as part of the assurance workflow. |
These are coverage areas, not a prescribed universal sequence or a claim that one tool category is sufficient. Select checks according to the code, control objective, deployment context, and pipeline stage. Build-time analysis, deployment and configuration review, dynamic testing, and runtime monitoring address different parts of the system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose priorities from the architecture, not a one-size-fits-all ranking
NIST and OWASP provide security considerations and architectural guidance, not a universal ranking of test methods for every stack. A practical prioritization can be made by combining four questions:
Recommended Free Tools
- Which layer is exposed? Consider service code, APIs and interactions, infrastructure, policy, and observability.
- Which control objective matters? Identify whether the concern is identity and authorization, data flow, secure communication and discovery, availability and resilience, or dependency integrity.
- Where does the boundary sit? Distinguish edge from internal calls, synchronous from asynchronous paths, and static from dynamic infrastructure; account for the actual gateway, mesh, and orchestration setup.
- At what stage can the check work? Choose among build-time analysis, deployment and configuration checks, runtime or dynamic testing, and continuing monitoring based on the control being assessed.
Use the resulting map to identify high-consequence data paths and trust boundaries, then ensure each has a relevant check and an owner. Revisit the map when services, permissions, routing, or deployment controls change; a test plan tied to an outdated architecture will not cover the current system.
Use screenshots only as supporting visual evidence
A screenshot can help document what a user-facing page displayed during a particular check, but it does not verify service authentication, API authorization, secure transport, or infrastructure policy. If a visual record is useful for a security workflow, ScreenshotNeo is a website screenshot API and MCP server; treat its captures as supplementary evidence, not as a security-testing control. Its capture flow can accept cookie or consent banners and remove known consent platforms, newsletter popups, and chat widgets before taking the screenshot, with each step configurable. Only clean shots are billed: bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, and responses include X-Page-Verdict and X-Billed headers. An MCP server exposes screenshot tools for AI agents.
Plans include 1,000 screenshots per month free with no card; paid plans start at $5 for 3,000. Sign up for ScreenshotNeo’s free plan.
Troubleshoot coverage gaps
- Tests pass at the gateway, but internal access is untested: enumerate service-to-service routes and test whether any path can bypass the gateway or its authorization enforcement.
- Service access is broadly permitted: trace each caller’s downstream API and storage permissions, then check whether they are limited to what that service needs.
- Controls exist in a mesh or shared platform, but coverage is unclear: inspect the deployed configuration and verify the resulting policies on the traffic paths they are intended to protect.
- Code scans pass, but deployment risks remain: include infrastructure, policy, and observability code in review rather than treating application-code results as system-wide assurance.
- Monitoring shows little about interactions or failures: check the observability configuration and whether it captures the security-relevant events needed for the system’s design.
- A test plan covers only synchronous APIs: add the asynchronous service and message-queue paths identified in the architecture inventory.
What the guidance can and cannot establish
The cited NIST publications date from 2019 to 2022, while the OWASP cheat sheets are living documents; implementation details should be checked against the current source material and the system’s actual stack. The guidance supports architecture-specific planning, but it does not establish a quantified increase in risk or testing effort, rank tools for every environment, or prove that a gateway or service mesh secures an implementation by itself.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
