AVA_VAN in Practice: Threat Models, Public Vulnerability Research, and Penetration Testing Expectations (W02a)
CC:2022 makes clear that AVA_VAN.3, .4, and .5 progressively require public-domain vulnerability searches, independent vulnerability analysis using guidance, design, architecture, and implementation representation, plus penetration testing against Enhanced-Basic, Moderate, or High attack potential. Developers need to know what artifacts and technical debt will be exposed before the evaluator does.