How can we load + pen test in AEMaaCS?

[IshaJa]

Looking for any suggestions/recommendations on how we can load and penetration test before our go-live date through Adobe? Appreciate any documentation or other references.

Thanks!

[Harwinder-singh]

@IshaJa In order to be able to proceed with the PEN test, you will need to get in touch with your Adobe Account Team who will fill out a non-disclosure form with you.

https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-19808

[IshaJa]

Hi @Harwinder-singh, I saw that.

Does this mean that Adobe would handle the PEN test? Or that we as the customer would need to handle it through an external vendor, but we still need to have a non-disclosure form filled out?

[Jörg_Hoh]

Adobe does test its own platform, but Adobe cannot do a test of your application.

[daniel-strmecki · Accepted solution]

For pen testing it is important to notify Adobe as they might consider your test an attact attempt and block it. For load testing I've only used Grafana K6, but I can recommend it as it is very simple to set up.

On my project we only do load testing on AEM publisher, bypassing CDN and Dispatcher (with a simple query parameter). We test for double the load that we observe in PROD AEM request logs.

Hope this helps a bit,

Daniel

[kautuk_sahni]

@IshaJa Did you find the suggestions helpful? Please let us know if you require more information. Otherwise, please mark the answer as correct for posterity. If you've discovered a solution yourself, we would appreciate it if you could share it with the community. Thank you!