how we test security software