ISECOM

What is ISECOM?

ISECOM (Institute for Security and Open Methodologies) is a non-profit security research organization founded in 2001 by Pete Herzog. ISECOM created and maintains the OSSTMM (Open Source Security Testing Methodology Manual), the RAV security metric, the OPST/OPSA/OPSE certifications, Hacker Highschool, and the Bad People Project.

What is the OSSTMM?

The OSSTMM (Open Source Security Testing Methodology Manual) is a peer-reviewed methodology for security testing across networks, systems, wireless, physical, and human channels. It defines repeatable controls, the RAV metric for quantitative scoring, and a vocabulary of operational security concepts. Free for non-commercial use; commercial licensing available.

What is the RAV (Risk Assessment Value)?

The RAV is ISECOM's security metric — a quantitative score derived from operational controls, attack surface, trust properties, and limitations, allowing security postures to be compared across systems, organizations, and over time. It is the math layer of the OSSTMM.

What certifications does ISECOM offer?

ISECOM offers OPST (Professional Security Tester) for hands-on testers, OPSA (Professional Security Analyst) for analysts working with results, and OPSE (Professional Security Expert) as the senior credential. All are based on OSSTMM methodology and require practical examination, not just multiple-choice.

Who founded ISECOM?

ISECOM was founded by Pete Herzog in 2001 as an evolution of his earlier ideahamster.org research collective. Pete is the lead author of the OSSTMM and continues to direct ISECOM's research.